doFuncReplace() in grammar/rainerscript.c implements replace(source, find, replaceWith) as two passes over the source string: pass 1 computes the output length, pass 2 allocates that many bytes with
es_newStr() and fills them. On partial-match failure the two passes rewind by different amounts — pass 1 does i -= (j - 1), pass 2 does i -= j — so pass 1 resumes scanning at matchStart + 2 while pass 2 resumes at matchStart + 1. Every match that begins one byte after a failed partial match is therefore counted by pass 2 but not by pass 1. When replaceWith is longer than find, each such match makes the allocation short by lReplaceWith - lfind bytes, and pass 2 writes past the end of the buffer. Neither store site is bounds-checked. The source string is normally a message property ($msg, $rawmsg, …), so an unauthenticated remote syslog sender chooses the number of missed matches and thus the size of the overflow.