From cb97426208b47ac9f5f376311407ce4ebd80858d Mon Sep 17 00:00:00 2001
From: Pavel Hrdina <phrdina@redhat.com>
Date: Sat, 28 Nov 2015 09:03:40 +0100
Subject: [PATCH] virlogd: fix crash if log file exists and it's larger the
 maxlen

If for some reason there is an existing log file, that is larger then
max length of log file, we need to rollover that file immediately.
Trying to figure out how much data we could write will resolve in
overflow of unsigned variable 'towrite' and this leads to segfault.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
---
 src/util/virrotatingfile.c  |  7 +++++-
 tests/virrotatingfiletest.c | 45 +++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/src/util/virrotatingfile.c b/src/util/virrotatingfile.c
index 1260710301..827b44b6f9 100644
--- a/src/util/virrotatingfile.c
+++ b/src/util/virrotatingfile.c
@@ -443,7 +443,12 @@ virRotatingFileWriterAppend(virRotatingFileWriterPtr file,
         size_t towrite = len;
         bool forceRollover = false;
 
-        if ((file->entry->pos + towrite) > file->maxlen) {
+        if (file->entry->pos > file->maxlen) {
+            /* If existing file is for some reason larger then max length we
+             * won't write to this file anymore, but we rollover this file.*/
+            forceRollover = true;
+            towrite = 0;
+        } else if ((file->entry->pos + towrite) > file->maxlen) {
             towrite = file->maxlen - file->entry->pos;
 
             /*
diff --git a/tests/virrotatingfiletest.c b/tests/virrotatingfiletest.c
index 03e9664347..44a59cdb17 100644
--- a/tests/virrotatingfiletest.c
+++ b/tests/virrotatingfiletest.c
@@ -515,6 +515,48 @@ static int testRotatingFileWriterRolloverLineBreak(const void *data ATTRIBUTE_UN
 }
 
 
+static int testRotatingFileWriterLargeFile(const void *data ATTRIBUTE_UNUSED)
+{
+    virRotatingFileWriterPtr file;
+    int ret = -1;
+    const char *buf = "The quick brown fox jumps over the lazy dog\n"
+        "The wizard quickly jinxed the gnomes before they vaporized\n";
+
+    if (testRotatingFileInitFiles(200,
+                                  (off_t)-1,
+                                  (off_t)-1) < 0)
+        return -1;
+
+    file = virRotatingFileWriterNew(FILENAME,
+                                    160,
+                                    2,
+                                    false,
+                                    0700);
+    if (!file)
+        goto cleanup;
+
+    if (testRotatingFileWriterAssertFileSizes(200,
+                                              (off_t)-1,
+                                              (off_t)-1) < 0)
+        goto cleanup;
+
+    virRotatingFileWriterAppend(file, buf, strlen(buf));
+
+    if (testRotatingFileWriterAssertFileSizes(103,
+                                              200,
+                                              (off_t)-1) < 0)
+        goto cleanup;
+
+    ret = 0;
+ cleanup:
+    virRotatingFileWriterFree(file);
+    unlink(FILENAME);
+    unlink(FILENAME0);
+    unlink(FILENAME1);
+    return ret;
+}
+
+
 static int testRotatingFileReaderOne(const void *data ATTRIBUTE_UNUSED)
 {
     virRotatingFileReaderPtr file;
@@ -681,6 +723,9 @@ mymain(void)
     if (virtTestRun("Rotating file write rollover line break", testRotatingFileWriterRolloverLineBreak, NULL) < 0)
         ret = -1;
 
+    if (virtTestRun("Rotating file write to file larger then maxlen", testRotatingFileWriterLargeFile, NULL) < 0)
+        ret = -1;
+
     if (virtTestRun("Rotating file read one", testRotatingFileReaderOne, NULL) < 0)
         ret = -1;