Frantisek Sumsal 35eb598af2 compress: gracefully handle a truncated ZSTD frame ...

If a journal file contains a truncated ZSTD frame (i.e. a frame with
Frame_Content_Size > 0, but with not enough data in Data_Block),
ZSTD_decompressStream() would return a non-zero, non-error value. This
would then skip the error path in the ZSTD_isError() branch and we'd hit
the following assert:

$ build-local/journalctl -o cat --file zstd-truncated.journal
Assertion 'output.pos >= prefix_len + 1' failed at src/basic/compress.c:1236, function decompress_startswith_zstd(). Aborting.
Aborted                    (core dumped) build-local/journalctl -o cat --file zstd-truncated.journal

Let's handle this situation gracefully and return EBADMSG instead.

Also, add another journalctl invocation to the corrupted-journals test
that goes through the sd_journal_get_data() -> decompress_startswith_zstd()
code path which, among other things, covers the issue when run on the
provided journal file.

2026-04-20 09:37:13 +02:00

..

corrupted

compress: gracefully handle a truncated ZSTD frame

2026-04-20 09:37:13 +02:00

no-rtc

…

afl-corrupted-journals.tar.zst

test: test journalctl with corrupted journals

2023-05-01 10:14:12 +02:00