[syslog-ng] [PATCH] logproto: Fix log_proto_file_writer_flush()'s partial construction.

[Gergely Nagy]

When log_proto_file_writer_flush() encountered a partial write, and
tried to construct a self->partial buffer, that contains all the data
we didn't write yet, the starting offset computation was... interesting.

What we want to copy into self->partial, is whatever is left in the
last, partially processed buffer (i0), then append the full contents
of the rest.

Calculating the starting offset of this first buffer was done in a
quite convoluted way, involving the sum of the length of the buffers
we already touched, the lenght of the last fully processed buffer, and
the total number of bytes already written.

This makes my head spin, especially since it can be simplified to
substracting the number of bytes to copy from the first buffer from
the total length of it.

The attached patch simplifies the offset calculation, and it also
fixes a subtle bug!

Lets assume 5 buffers, the first one 100, the second 200, the third
300, the fourth 400 and the fifth 500 bytes, totalling to 1500
bytes. Lets assume we managed to write out the first three buffers,
and half of the fourht: 800 bytes.

In this case, rc will be 800, sum will be 1000, i0 will be 3, and ofs
will be 200. So far, all is well. But when we try to compute the
starting offset within the first partial buffer, we end up with: rc -
(sum - buf[i0 - 1].length), which, when values are substituted
becomes: 800 - (1000 - 300) = 100!

This is obviously not correct: we've already written out half of the
fourth buffer, yet, we start copying from the 100th byte instead of
the 200th!

After the fix, when the starting position is buffer[i0].length - ofs,
we get the correct value of 200, and all is well.

Reported-by: SZALAY Attila <sasa at balabit.hu>
Signed-off-by: Gergely Nagy <algernon at balabit.hu>
---
 lib/logproto.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/lib/logproto.c b/lib/logproto.c
index bdf9695..5047c98 100644
--- a/lib/logproto.c
+++ b/lib/logproto.c
@@ -299,7 +299,7 @@ log_proto_file_writer_flush(LogProto *s)
       /* allocate and copy the remaning data */
       self->partial = (guchar *)g_malloc(self->partial_len);
       ofs = sum - rc; /* the length of the remaning (not processed) chunk in the first message */
-        memcpy(self->partial, self->buffer[i0].iov_base + rc - (i0 > 0 ? (sum - self->buffer[i0 - 1].iov_len) : 0), ofs);
+      memcpy(self->partial, self->buffer[i0].iov_len - ofs, ofs);
       i = i0 + 1;
       while (i < self->buf_count)
         {
-- 
1.7.7.1