filter: fix theoretical overread on long records

The concern is that the read length can be longer than MAX_AUDIT_MESSAGE_LENGTH. If that were the case, the strncpy keeps it the right size, but len is not adjusted. Which can lead to an overread later.

In practice, MAX_AUDIT_MESSAGE_LENGTH was selected as the limit for records throughout the audit system. Unless you're dealing with a corrupted record, this should never happen.

Author: stevegrubb

auplugin/auplugin.c

@@ -127,14 +127,18 @@ static void common_inbound(void)
 			int len;
 			if ((len = auplugin_fgets(rx_buf,
 				    MAX_AUDIT_EVENT_FRAME_SIZE + 1, fd)) > 0) {
+				size_t copy_len;
+
 				// Got one - enqueue it
 				event_t *e = (event_t *)calloc(1,
 					 sizeof(event_t));
 				if (e) {
-					strncpy(e->data, rx_buf,
-						MAX_AUDIT_MESSAGE_LENGTH);
-					e->data[MAX_AUDIT_MESSAGE_LENGTH-1] = 0;
-					e->hdr.size = len;
+					copy_len = (size_t)len;
+					if (copy_len >= MAX_AUDIT_MESSAGE_LENGTH)
+						copy_len = MAX_AUDIT_MESSAGE_LENGTH - 1;
+					memcpy(e->data, rx_buf, copy_len);
+					e->data[copy_len] = 0;
+					e->hdr.size = copy_len;
 					e->hdr.ver = AUDISP_PROTOCOL_VER2;
 					enqueue(e, &q_config);
 				}