Attachment 938140 Details for Bug 1142373 – rsyslog CVE-2014-3634 fix for v8

[patch] rsyslog CVE-2014-3634 fix for v8

prifix.v8-stable (text/plain), 16.27 KB, created by Vincent Danen on 2014-09-16 16:29:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Vincent Danen

Created: 2014-09-16 16:29:01 UTC

Size: 16.27 KB

patch

obsolete

>diff --git a/ChangeLog b/ChangeLog
>index eafb645..a1544f2 100644
>--- a/ChangeLog
>+++ b/ChangeLog
>@@ -4546,6 +4546,8 @@ Version 3.22.4 [v3-stable] (rgerhards), 2010-??-??
>   closes: http://bugzilla.adiscon.com/show_bug.cgi?id=271
> - improved some code based on clang static analyzer results
> - bugfix: potential misadressing in property replacer
>+- bugfix: improper handling of invalid PRI values
>+  references: CVE-2014-3634
> ---------------------------------------------------------------------------
> Version 3.22.3 [v3-stable] (rgerhards), 2010-11-24
> - bugfix(important): problem in TLS handling could cause rsyslog to loop
>diff --git a/configure.ac b/configure.ac
>index 6d8d76d..ab34bee 100644
>--- a/configure.ac
>+++ b/configure.ac
>@@ -88,7 +88,7 @@ AC_SUBST(DL_LIBS)
> AC_HEADER_RESOLV
> AC_HEADER_STDC
> AC_HEADER_SYS_WAIT
>-AC_CHECK_HEADERS([arpa/inet.h libgen.h malloc.h fcntl.h locale.h netdb.h netinet/in.h paths.h stddef.h stdlib.h string.h sys/file.h sys/ioctl.h sys/param.h sys/socket.h sys/time.h sys/stat.h sys/inotify.h syslog.h unistd.h utmp.h utmpx.h sys/epoll.h sys/prctl.h])
>+AC_CHECK_HEADERS([arpa/inet.h libgen.h malloc.h fcntl.h locale.h netdb.h netinet/in.h paths.h stddef.h stdlib.h string.h sys/file.h sys/ioctl.h sys/param.h sys/socket.h sys/time.h sys/stat.h sys/inotify.h unistd.h utmp.h utmpx.h sys/epoll.h sys/prctl.h])
> 
> # Checks for typedefs, structures, and compiler characteristics.
> AC_C_CONST
>diff --git a/grammar/rainerscript.h b/grammar/rainerscript.h
>index 8742c75..453b0f3 100644
>--- a/grammar/rainerscript.h
>+++ b/grammar/rainerscript.h
>@@ -25,7 +25,7 @@
> #include <regex.h>
> #include "typedefs.h"
> 
>-#define	LOG_NFACILITIES	24	/* current number of syslog facilities */
>+#define LOG_NFACILITIES 24+1 /* we copy&paste this as including rsyslog.h gets us in off64_t trouble... :-( */
> #define CNFFUNC_MAX_ARGS 32
> 	/**< maximum number of arguments that any function can have (among
> 	 *   others, this is used to size data structures).
>diff --git a/plugins/imfile/imfile.c b/plugins/imfile/imfile.c
>index 740a345..d37cb03 100644
>--- a/plugins/imfile/imfile.c
>+++ b/plugins/imfile/imfile.c
>@@ -376,8 +376,8 @@ static rsRetVal enqLine(fileInfo_t *pInfo, cstr_t *cstrLine)
> 	MsgSetMSGoffs(pMsg, 0);	/* we do not have a header... */
> 	MsgSetHOSTNAME(pMsg, glbl.GetLocalHostName(), ustrlen(glbl.GetLocalHostName()));
> 	MsgSetTAG(pMsg, pInfo->pszTag, pInfo->lenTag);
>-	pMsg->iFacility = LOG_FAC(pInfo->iFacility);
>-	pMsg->iSeverity = LOG_PRI(pInfo->iSeverity);
>+	pMsg->iFacility = pri2fac(pInfo->iFacility);
>+	pMsg->iSeverity = pri2sev(pInfo->iSeverity);
> 	MsgSetRuleset(pMsg, pInfo->pRuleset);
> 	ratelimitAddMsg(pInfo->ratelimiter, &pInfo->multiSub, pMsg);
> finalize_it:
>diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
>index 51a4aa7..6a97b25 100644
>--- a/plugins/imjournal/imjournal.c
>+++ b/plugins/imjournal/imjournal.c
>@@ -91,8 +91,8 @@ static struct cnfparamblk modpblk =
> 	};
> 
> #define DFLT_persiststateinterval 10
>-#define DFLT_SEVERITY LOG_PRI(LOG_NOTICE)
>-#define DFLT_FACILITY LOG_FAC(LOG_USER)
>+#define DFLT_SEVERITY pr2fac(LOG_NOTICE)
>+#define DFLT_FACILITY pri2sev(LOG_USER)
> 
> static int bLegacyCnfModGlobalsPermitted = 1;/* are legacy module-global config parameters permitted? */
> 
>@@ -125,7 +125,7 @@ static rsRetVal facilityHdlr(uchar **pp, void *pVal)
> 			/* noop */;
> 		for (c = syslogFacNames; c->c_name; c++) {
> 			if (!strncasecmp(p, (char *) c->c_name, len)) {
>-				*((int *) pVal) = LOG_FAC(c->c_val);
>+				*((int *) pVal) = pri2fac(c->c_val);
> 				break;
> 			}
> 		}
>diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c
>index 810ac26..4a76340 100644
>--- a/plugins/imklog/imklog.c
>+++ b/plugins/imklog/imklog.c
>@@ -21,7 +21,7 @@
>  * To test under Linux:
>  * echo test1 > /dev/kmsg
>  *
>- * Copyright (C) 2008-2012 Adiscon GmbH
>+ * Copyright (C) 2008-2014 Adiscon GmbH
>  *
>  * This file is part of rsyslog.
>  *
>@@ -247,10 +247,10 @@ rsRetVal Syslog(int priority, uchar *pMsg, struct timeval *tp)
> 	/* if we don't get the pri, we use whatever we were supplied */
> 
> 	/* ignore non-kernel messages if not permitted */
>-	if(cs.bPermitNonKernel == 0 && LOG_FAC(priority) != LOG_KERN)
>+	if(cs.bPermitNonKernel == 0 && pri2fac(priority) != LOG_KERN)
> 		FINALIZE; /* silently ignore */
> 
>-	iRet = enqMsg((uchar*)pMsg, (uchar*) "kernel:", LOG_FAC(priority), LOG_PRI(priority), tp);
>+	iRet = enqMsg((uchar*)pMsg, (uchar*) "kernel:", pri2fac(priority), pri2sev(priority), tp);
> 
> finalize_it:
> 	RETiRet;
>diff --git a/plugins/imkmsg/imkmsg.c b/plugins/imkmsg/imkmsg.c
>index 2a97f82..8588223 100644
>--- a/plugins/imkmsg/imkmsg.c
>+++ b/plugins/imkmsg/imkmsg.c
>@@ -144,7 +144,7 @@ rsRetVal imkmsgLogIntMsg(int priority, char *fmt, ...)
> rsRetVal Syslog(int priority, uchar *pMsg, struct timeval *tp, struct json_object *json)
> {
> 	DEFiRet;
>-	iRet = enqMsg((uchar*)pMsg, (uchar*) "kernel:", LOG_FAC(priority), LOG_PRI(priority), tp, json);
>+	iRet = enqMsg((uchar*)pMsg, (uchar*) "kernel:", pri2fac(priority), pri2sev(priority), tp, json);
> 	RETiRet;
> }
> 
>diff --git a/plugins/imsolaris/imsolaris.c b/plugins/imsolaris/imsolaris.c
>index a220e72..36677e7 100644
>--- a/plugins/imsolaris/imsolaris.c
>+++ b/plugins/imsolaris/imsolaris.c
>@@ -209,8 +209,8 @@ readLog(int fd, uchar *pRcv, int iMaxLine)
> 		MsgSetInputName(pMsg, pInputName);
> 		MsgSetRawMsg(pMsg, (char*)pRcv, strlen((char*)pRcv));
> 		MsgSetHOSTNAME(pMsg, glbl.GetLocalHostName(), ustrlen(glbl.GetLocalHostName()));
>-		pMsg->iFacility = LOG_FAC(hdr.pri);
>-		pMsg->iSeverity = LOG_PRI(hdr.pri);
>+		pMsg->iFacility = pri2fac(hdr.pri);
>+		pMsg->iSeverity = pri2sev(hdr.pri);
> 		pMsg->msgFlags = NEEDS_PARSING | NO_PRI_IN_RAW;
> 		CHKiRet(submitMsg(pMsg));
> 	}
>diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c
>index a79fcc5..d99bed8 100644
>--- a/plugins/imuxsock/imuxsock.c
>+++ b/plugins/imuxsock/imuxsock.c
>@@ -6,7 +6,7 @@
>  *
>  * File begun on 2007-12-20 by RGerhards (extracted from syslogd.c)
>  *
>- * Copyright 2007-2013 Rainer Gerhards and Adiscon GmbH.
>+ * Copyright 2007-2014 Rainer Gerhards and Adiscon GmbH.
>  *
>  * This file is part of rsyslog.
>  *
>@@ -772,8 +772,8 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
> 		++parse;
> 		++offs;
> 	} 
>-	facil = LOG_FAC(pri);
>-	sever = LOG_PRI(pri);
>+	facil = pri2fac(pri);
>+	sever = pri2sev(pri);
> 
> 	findRatelimiter(pLstn, cred, &ratelimiter); /* ignore error, better so than others... */
> 
>diff --git a/plugins/omprog/omprog.c b/plugins/omprog/omprog.c
>index 93dfbb4..2ba0b94 100644
>--- a/plugins/omprog/omprog.c
>+++ b/plugins/omprog/omprog.c
>@@ -27,6 +27,7 @@
> #include "config.h"
> #include "rsyslog.h"
> #include <stdio.h>
>+#include <syslog.h>
> #include <stdarg.h>
> #include <stdlib.h>
> #include <string.h>
>diff --git a/runtime/msg.c b/runtime/msg.c
>index 81b13f9..0788808 100644
>--- a/runtime/msg.c
>+++ b/runtime/msg.c
>@@ -125,7 +125,7 @@ static char *years[] = {
> static struct {
> 	uchar *pszName;
> 	short lenName;
>-} syslog_pri_names[192] = {
>+} syslog_pri_names[200] = {
> 	{ UCHAR_CONSTANT("0"), 3},
> 	{ UCHAR_CONSTANT("1"), 3},
> 	{ UCHAR_CONSTANT("2"), 3},
>@@ -317,22 +317,30 @@ static struct {
> 	{ UCHAR_CONSTANT("188"), 5},
> 	{ UCHAR_CONSTANT("189"), 5},
> 	{ UCHAR_CONSTANT("190"), 5},
>-	{ UCHAR_CONSTANT("191"), 5}
>+	{ UCHAR_CONSTANT("191"), 5},
>+	{ UCHAR_CONSTANT("192"), 5},
>+	{ UCHAR_CONSTANT("193"), 5},
>+	{ UCHAR_CONSTANT("194"), 5},
>+	{ UCHAR_CONSTANT("195"), 5},
>+	{ UCHAR_CONSTANT("196"), 5},
>+	{ UCHAR_CONSTANT("197"), 5},
>+	{ UCHAR_CONSTANT("198"), 5},
>+	{ UCHAR_CONSTANT("199"), 5}
> 	};
> static char hexdigit[16] =
> 	{'0', '1', '2', '3', '4', '5', '6', '7', '8',
> 	 '9', 'A', 'B', 'C', 'D', 'E', 'F' };
> 
> /*syslog facility names (as of RFC5424) */
>-static char *syslog_fac_names[24] = { "kern", "user", "mail", "daemon", "auth", "syslog", "lpr",
>+static char *syslog_fac_names[LOG_NFACILITIES] = { "kern", "user", "mail", "daemon", "auth", "syslog", "lpr",
> 			    	      "news", "uucp", "cron", "authpriv", "ftp", "ntp", "audit",
> 			    	      "alert", "clock", "local0", "local1", "local2", "local3",
>-			    	      "local4", "local5", "local6", "local7" };
>+			    	      "local4", "local5", "local6", "local7", "invld" };
> /* length of the facility names string (for optimizatiions) */
>-static short len_syslog_fac_names[24] = { 4, 4, 4, 6, 4, 6, 3,
>+static short len_syslog_fac_names[LOG_NFACILITIES] = { 4, 4, 4, 6, 4, 6, 3,
> 			    	          4, 4, 4, 8, 3, 3, 5,
> 			    	          5, 5, 6, 6, 6, 6,
>-			    	          6, 6, 6, 6 };
>+			    	          6, 6, 6, 6, 5 };
> 
> /* table of severity names (in numerical order)*/
> static char *syslog_severity_names[8] = { "emerg", "alert", "crit", "err", "warning", "notice", "info", "debug" };
>@@ -342,8 +350,8 @@ static short len_syslog_severity_names[8] = { 5, 5, 4, 3, 7, 6, 4, 5 };
>  * and facility values to a numerical string... -- rgerhars, 2009-06-17
>  */
> 
>-static char *syslog_number_names[24] = { "0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14",
>-					 "15", "16", "17", "18", "19", "20", "21", "22", "23" };
>+static char *syslog_number_names[LOG_NFACILITIES] = { "0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14",
>+					 "15", "16", "17", "18", "19", "20", "21", "22", "23", "24" };
> 
> /* global variables */
> #if defined(HAVE_MALLOC_TRIM) && !defined(HAVE_ATOMIC_BUILTINS)
>@@ -700,8 +708,8 @@ static inline rsRetVal msgBaseConstruct(msg_t **ppThis)
> 	pM->flowCtlType = 0;
> 	pM->bParseSuccess = 0;
> 	pM->iRefCount = 1;
>-	pM->iSeverity = -1;
>-	pM->iFacility = -1;
>+	pM->iSeverity = LOG_DEBUG;
>+	pM->iFacility = LOG_INVLD;
> 	pM->iLenPROGNAME = -1;
> 	pM->offAfterPRI = 0;
> 	pM->offMSG = -1;
>@@ -2626,11 +2634,11 @@ void MsgSetRawMsgWOSize(msg_t * const pMsg, char* pszRawMsg)
> char *textpri(char *pRes, int pri)
> {
> 	assert(pRes != NULL);
>-	memcpy(pRes, syslog_fac_names[LOG_FAC(pri)], len_syslog_fac_names[LOG_FAC(pri)]);
>-	pRes[len_syslog_fac_names[LOG_FAC(pri)]] = '.';
>-	memcpy(pRes+len_syslog_fac_names[LOG_FAC(pri)]+1,
>-	       syslog_severity_names[LOG_PRI(pri)],
>-	       len_syslog_severity_names[LOG_PRI(pri)]+1 /* for \0! */);
>+	memcpy(pRes, syslog_fac_names[pri2fac(pri)], len_syslog_fac_names[pri2fac(pri)]);
>+	pRes[len_syslog_fac_names[pri2fac(pri)]] = '.';
>+	memcpy(pRes+len_syslog_fac_names[pri2fac(pri)]+1,
>+	       syslog_severity_names[pri2sev(pri)],
>+	       len_syslog_severity_names[pri2sev(pri)]+1 /* for \0! */);
> 	return pRes;
> }
> 
>diff --git a/runtime/parser.c b/runtime/parser.c
>index 5607484..1baa502 100644
>--- a/runtime/parser.c
>+++ b/runtime/parser.c
>@@ -620,11 +620,11 @@ ParsePRI(msg_t *pMsg)
> 			}
> 			if(*msg == '>')
> 				++msg;
>-			if(pri & ~(LOG_FACMASK|LOG_PRIMASK))
>-				pri = DEFUPRI;
>+			if(pri > LOG_MAXPRI)
>+				pri = LOG_PRI_INVLD;
> 		}
>-		pMsg->iFacility = LOG_FAC(pri);
>-		pMsg->iSeverity = LOG_PRI(pri);
>+		pMsg->iFacility = pri2fac(pri);
>+		pMsg->iSeverity = pri2sev(pri);
> 		MsgSetAfterPRIOffs(pMsg, msg - pMsg->pszRawMsg);
> 	}
> 	RETiRet;
>diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h
>index 20cd70d..f7d5b8a 100644
>--- a/runtime/rsyslog.h
>+++ b/runtime/rsyslog.h
>@@ -77,19 +77,58 @@
>  * #                  End Config Settings                      # *
>  * ############################################################# */
> 
>-/* portability: not all platforms have these defines, so we
>- * define them here if they are missing. -- rgerhards, 2008-03-04
>+/* make sure we uses consistent macros, no matter what the
>+ * platform gives us.
>  */
>-#ifndef LOG_MAKEPRI
>-#	define	LOG_MAKEPRI(fac, pri)	(((fac) << 3) | (pri))
>-#endif
>-#ifndef LOG_PRI
>-#	define	LOG_PRI(p)	((p) & LOG_PRIMASK)
>-#endif
>-#ifndef LOG_FAC
>-#	define	LOG_FAC(p)	(((p) & LOG_FACMASK) >> 3)
>-#endif
>-
>+#define LOG_NFACILITIES 24+1 /* plus one for our special "invld" facility! */
>+#define LOG_MAXPRI 191	/* highest supported valid PRI value --> RFC3164, RFC5424 */
>+#undef LOG_MAKEPRI
>+#define LOG_PRI_INVLD	LOG_INVLD|LOG_DEBUG	/* PRI is invalid --> special "invld.=debug" PRI code (rsyslog-specific) */
>+
>+#define	LOG_EMERG	0	/* system is unusable */
>+#define	LOG_ALERT	1	/* action must be taken immediately */
>+#define	LOG_CRIT	2	/* critical conditions */
>+#define	LOG_ERR		3	/* error conditions */
>+#define	LOG_WARNING	4	/* warning conditions */
>+#define	LOG_NOTICE	5	/* normal but significant condition */
>+#define	LOG_INFO	6	/* informational */
>+#define	LOG_DEBUG	7	/* debug-level messages */
>+
>+#define	LOG_KERN	(0<<3)	/* kernel messages */
>+#define	LOG_USER	(1<<3)	/* random user-level messages */
>+#define	LOG_MAIL	(2<<3)	/* mail system */
>+#define	LOG_DAEMON	(3<<3)	/* system daemons */
>+#define	LOG_AUTH	(4<<3)	/* security/authorization messages */
>+#define	LOG_SYSLOG	(5<<3)	/* messages generated internally by syslogd */
>+#define	LOG_LPR		(6<<3)	/* line printer subsystem */
>+#define	LOG_NEWS	(7<<3)	/* network news subsystem */
>+#define	LOG_UUCP	(8<<3)	/* UUCP subsystem */
>+#define	LOG_CRON	(9<<3)	/* clock daemon */
>+#define	LOG_AUTHPRIV	(10<<3)	/* security/authorization messages (private) */
>+#define	LOG_FTP		(11<<3)	/* ftp daemon */
>+#define	LOG_LOCAL0	(16<<3)	/* reserved for local use */
>+#define	LOG_LOCAL1	(17<<3)	/* reserved for local use */
>+#define	LOG_LOCAL2	(18<<3)	/* reserved for local use */
>+#define	LOG_LOCAL3	(19<<3)	/* reserved for local use */
>+#define	LOG_LOCAL4	(20<<3)	/* reserved for local use */
>+#define	LOG_LOCAL5	(21<<3)	/* reserved for local use */
>+#define	LOG_LOCAL6	(22<<3)	/* reserved for local use */
>+#define	LOG_LOCAL7	(23<<3)	/* reserved for local use */
>+#define LOG_FAC_INVLD   24
>+#define	LOG_INVLD	(LOG_FAC_INVLD<<3)	/* invalid facility/PRI code */
>+
>+/* we need to use a function to avoid side-effects. This MUST guard
>+ * against invalid facility values. rgerhards, 2014-09-16
>+ */
>+static inline int pri2fac(const int pri)
>+{
>+	int fac = pri >> 3;
>+	return (fac > 23) ? LOG_FAC_INVLD : fac;
>+}
>+static inline int pri2sev(const int pri)
>+{
>+	return pri & 0x07;
>+}
> 
> /* the rsyslog core provides information about present feature to plugins
>  * asking it. Below are feature-test macros which must be used to query
>diff --git a/runtime/srutils.c b/runtime/srutils.c
>index 6d842ab..d7e71ed 100644
>--- a/runtime/srutils.c
>+++ b/runtime/srutils.c
>@@ -105,6 +105,7 @@ syslogName_t	syslogFacNames[] = {
> 	{"local5",       LOG_LOCAL5},
> 	{"local6",       LOG_LOCAL6},
> 	{"local7",       LOG_LOCAL7},
>+	{"invld",        LOG_INVLD},
> 	{NULL,           -1},
> };
> 
>diff --git a/runtime/syslogd-types.h b/runtime/syslogd-types.h
>index 4023bab..fe9dfa9 100644
>--- a/runtime/syslogd-types.h
>+++ b/runtime/syslogd-types.h
>@@ -4,7 +4,7 @@
>  *
>  * File begun on 2007-07-13 by RGerhards (extracted from syslogd.c)
>  *
>- * Copyright 2007-2012 Adiscon GmbH.
>+ * Copyright 2007-2014 Adiscon GmbH.
>  *
>  * This file is part of the rsyslog runtime library.
>  *
>@@ -27,12 +27,6 @@
> 
> #include "stringbuf.h"
> #include <sys/param.h>
>-#if HAVE_SYSLOG_H
>-#include <syslog.h>
>-#endif
>-/* define a macro missing on a few platforms */
>-#undef LOG_FACMASK /* prevent redef warning ;) */
>-#define LOG_FACMASK 191
> 
> /* we use RSTRUE/FALSE to prevent name claches with other packages */
> #define RSFALSE 0
>diff --git a/runtime/typedefs.h b/runtime/typedefs.h
>index f2f5af6..bf92021 100644
>--- a/runtime/typedefs.h
>+++ b/runtime/typedefs.h
>@@ -268,4 +268,8 @@ struct msgPropDescr_s {
> 	int nameLen;		/* properties (JSON) */
> };
> 
>+/* some forward-definitions from the grammar */
>+struct nvlst;
>+struct cnfobj;
>+
> #endif /* multi-include protection */
>diff --git a/tools/rsyslogd.c b/tools/rsyslogd.c
>index abff2c6..a0fe02c 100644
>--- a/tools/rsyslogd.c
>+++ b/tools/rsyslogd.c
>@@ -491,8 +491,8 @@ logmsgInternalSelf(const int iErr, const int pri, const size_t lenMsg,
> 		pszTag[32] = '\0'; /* just to make sure... */
> 		MsgSetTAG(pMsg, pszTag, len);
> 	}
>-	pMsg->iFacility = LOG_FAC(pri);
>-	pMsg->iSeverity = LOG_PRI(pri);
>+	pMsg->iFacility = pri2fac(pri);
>+	pMsg->iSeverity = pri2sev(pri);
> 	flags |= INTERNAL_MSG;
> 	pMsg->msgFlags  = flags;
> 
>@@ -540,7 +540,7 @@ logmsgInternal(int iErr, int pri, const uchar *const msg, int flags)
> 					   (bufModMsg == NULL) ? (char*)msg : bufModMsg,
> 					   flags));
> 	} else {
>-		stdlog_log(stdlog_hdl, LOG_PRI(pri), "%s",
>+		stdlog_log(stdlog_hdl, pri2sev(pri), "%s",
> 			   (bufModMsg == NULL) ? (char*)msg : bufModMsg);
> 	}
> 
>@@ -553,7 +553,7 @@ logmsgInternal(int iErr, int pri, const uchar *const msg, int flags)
> 	 * supressor statement.
> 	 */
> 	if(((Debug == DEBUG_FULL || !doFork) && ourConf->globals.bErrMsgToStderr) || iConfigVerify) {
>-		if(LOG_PRI(pri) == LOG_ERR)
>+		if(pri2sev(pri) == LOG_ERR)
> 			fprintf(stderr, "rsyslogd: %s\n", (bufModMsg == NULL) ? (char*)msg : bufModMsg);
> 	}
>

Actions: View | Diff

Attachments on bug 1142373: 938140 | 938141 | 938142 | 938143 | 938229 | 943495 | 943496 | 943575 | 943701 | 943702