[syslog-ng] [Bug 235] New: String arguments to block parameters get mistreated

bugzilla at bugzilla.balabit.com bugzilla at bugzilla.balabit.com
Wed May 8 17:08:56 CEST 2013


https://bugzilla.balabit.com/show_bug.cgi?id=235

           Summary: String arguments to block parameters get mistreated
           Product: syslog-ng
           Version: 3.4.x
          Platform: All
        OS/Version: All
            Status: ASSIGNED
          Severity: blocker
          Priority: unspecified
         Component: syslog-ng
        AssignedTo: algernon at balabit.hu
        ReportedBy: algernon at balabit.hu
Type of the Report: regression
   Estimated Hours: 0.0


I'm not quite sure who and where reported this bug first, but I'm recording it within Bugzilla, so we can keep track of it.

With the config below, syslog-ng fails to start:

==========================================================
@version: 3.5

block source s_logfile (filename(messages)) {
  file("/var/log/`filename`" );
};

source s_example {
  s_logfile(filename("logfile.log"));
  s_logfile(filename(logfile.log));
  s_logfile(filename(foo bar baz));
};
==========================================================

Error parsing affile, syntax error, unexpected LL_IDENTIFIER in source block s_logfile at line 2, column 19:
                                                  included from etc/block-syntax.conf line 8, column 36

  file("/var/log/"logfile.log
                  ^^^^^^^^^^^

The first line of s_example makes it fail badly. This is because the lexer recognises "logfile.log" as a block_string, and stores the quotation marks too,
therefore the backtick expansion creates an invalid string. We should not store the "s in this case.

I managed to bisect this down to cbd8b195e80f54f9b398456d434e39d9d23c2bdd, but have not managed to figure out how to fix the problem yet, without breaking
anything else.

syslog-ng 3.3 is not affected, but the last s_logfile() statement doesn't work there.


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.


More information about the syslog-ng mailing list