Proposed fix for CVE-2020-8445

src/analysisd/cleanevent.c

@@ -63,6 +63,9 @@ int OS_CleanMSG(char *msg, Eventinfo *lf)
 
     os_strdup(msg, lf->location);
 
+    /*CVE-2020-8445 fix*/
+    remove_control_characters(pieces);
+
     /* Get the log length */
     loglen = strlen(pieces) + 1;
 
@@ -467,7 +470,7 @@ int OS_CleanMSG(char *msg, Eventinfo *lf)
                      (done_message == 0)) {
                 pieces += 8;
                 done_message = 1;
-
+                
                 lf->log = pieces;
 
                 /* Get the closing brackets */

src/headers/file_op.h

@@ -13,8 +13,8 @@
 #define __FILE_H
 
 #include <time.h>
-
-#define OS_PIDFILE  "/var/run"
+#include <stdbool.h>
+#define OS_PIDFILE "/var/run"
 
 /* Set the program name - must be done before *anything* else */
 void OS_SetName(const char *name) __attribute__((nonnull));
@@ -59,5 +59,9 @@ int checkVista();
 int isVista;
 #endif
 
-int w_ref_parent_folder(const char * path);
+int w_ref_parent_folder(const char *path);
+
+void remove_control_characters(char *str);
+
+bool is_control_character(char c);
 #endif /* __FILE_H */

src/shared/file_op.c

@@ -12,7 +12,7 @@
 
 #include <errno.h>
 #include <string.h>
-
+#include <stdbool.h>
 #include "shared.h"
 
 #ifndef WIN32
@@ -1582,3 +1582,23 @@ int w_ref_parent_folder(const char * path) {
 
     return 0;
 }
+
+bool is_control_character(char c) {
+    return (c >= 0 && c <= 31) || c == 127 || c == '\n';
+}
+
+void remove_control_characters(char *str) {
+    int len = strlen(str);
+    int i, j;
+
+    for (i = 0, j = 0; i < len; i++) {
+        if (!is_control_character(str[i])) {
+            str[j] = str[i];
+            j++;
+        } else {
+            DEBUG_MSG("%s:DEBUG: control character removed: %d",ARGV0, str[i]);
+        }
+    }
+
+    str[j] = '\0'; // Null-terminate the string after removing control characters
+}