Bug#1145386: trixie-pu: package rsyslog/8.2504.0-1+deb13u1

diff --git a/debian/changelog b/debian/changelog
index 4916e31e5..14930e3c5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,24 @@
+rsyslog (8.2504.0-1+deb13u2) trixie; urgency=medium
+
+  * rainerscript: Avoid heap buffer overflow in replace() function.
+    Patch cherry-picked from upstream Git.
+    (CVE-2026-78002, Closes: #1145980)
+  * mmpstrucdata: Fix stack buffer overflow with oversized RFC5424 structured
+    data.
+    Patch backported from upstream Git.
+    (CVE-2026-61548)
+
+ -- Michael Biebl <[email protected]>  Sun, 30 Aug 2026 02:19:20 +0200
+
+rsyslog (8.2504.0-1+deb13u1) trixie; urgency=medium
+
+  * omfwd regression fix: avoid false active target change log message.
+    Patch backported from upstream Git. (Closes: #1141981)
+  * imptcp: reject invalid regex-framing recovery transitions.
+    (CVE-2026-19654, Closes: #1144616)
+
+ -- Michael Biebl <[email protected]>  Mon, 24 Aug 2026 15:56:02 +0200
+
 rsyslog (8.2504.0-1) unstable; urgency=medium
 
   * New upstream version 8.2504.0
diff --git a/debian/gbp.conf b/debian/gbp.conf
index 05e704d03..3477505d6 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -1,5 +1,5 @@
 [DEFAULT]
 pristine-tar = True
 patch-numbers = False
-debian-branch = debian/master
+debian-branch = debian/trixie
 upstream-branch = upstream/latest
diff --git a/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch b/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch
new file mode 100644
index 000000000..bb7d7b262
--- /dev/null
+++ b/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch
@@ -0,0 +1,44 @@
+From: Rainer Gerhards <[email protected]>
+Date: Mon, 20 Jul 2026 17:19:28 +0200
+Subject: imptcp: guard regex framing match at line start
+
+Why
+A regex match at the beginning of the receive buffer can form a
+negative message length after oversize-frame recovery.
+
+Impact
+Regex-framed imptcp listeners reject that invalid transition instead
+of submitting a negative message length.
+
+Before/After
+Before: a match with a zero line offset submitted an invalid length.
+After: only a match following an existing line can submit a frame.
+
+Technical Overview
+Mirror the line-offset guard used by the shared imtcp parser.
+Leave existing regex framing and oversize recovery behavior unchanged.
+
+Security advisory:
+https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29
+
+Reported-by: Raphael Eikenberg (@eikendev)
+With the help of AI-Agents: Codex
+
+(cherry picked from commit 07b3c40a5a78c79ed9109251f842ca7e955dd586)
+---
+ plugins/imptcp/imptcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c
+index 9223f20..16d2c32 100644
+--- a/plugins/imptcp/imptcp.c
++++ b/plugins/imptcp/imptcp.c
+@@ -1054,7 +1054,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const __restrict__ pThis,
+ 		pThis->iCurrLine = pThis->iMsg;
+ 	} else {
+ 		const int isMatch = !regexec(&inst->start_preg, (char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0);
+-		if(isMatch) {
++		if (pThis->iCurrLine > 0 && isMatch) {
+ 			DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg);
+ 			strcpy((char*)pThis->pMsg_save, (char*) pThis->pMsg+pThis->iCurrLine);
+ 			pThis->iMsg = pThis->iCurrLine - 1;
diff --git a/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch b/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch
new file mode 100644
index 000000000..f456af8fa
--- /dev/null
+++ b/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch
@@ -0,0 +1,41 @@
+From: Rainer Gerhards <[email protected]>
+Date: Tue, 2 Jun 2026 14:00:15 +0200
+Subject: mmpstrucdata: Fix stack buffer overflow with oversized RFC5424
+ structured data
+
+Partial backport of commit bcda60a3692efdf0c8e44102528f5a0ebe0dec6d
+
+See https://github.com/rsyslog/rsyslog/security/advisories/GHSA-8qmr-c66f-g368
+---
+ plugins/mmpstrucdata/mmpstrucdata.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/plugins/mmpstrucdata/mmpstrucdata.c b/plugins/mmpstrucdata/mmpstrucdata.c
+index 5f1ca80..eb81047 100644
+--- a/plugins/mmpstrucdata/mmpstrucdata.c
++++ b/plugins/mmpstrucdata/mmpstrucdata.c
+@@ -256,7 +256,7 @@ parseSD_PARAM(instanceData *const pData, uchar *sdbuf, int lenbuf, int *curridx,
+ {
+ 	int i;
+ 	uchar pName[33];
+-	uchar pVal[32*1024];
++	uchar *pVal = NULL;
+ 	struct json_object *jval;
+ 	DEFiRet;
+ 	
+@@ -270,6 +270,7 @@ parseSD_PARAM(instanceData *const pData, uchar *sdbuf, int lenbuf, int *curridx,
+ 		ABORT_FINALIZE(RS_RET_STRUC_DATA_INVLD);
+ 	}
+ 	++i;
++	CHKmalloc(pVal = malloc(lenbuf - i + 1));
+ 	CHKiRet(parsePARAM_VALUE(sdbuf, lenbuf, &i, pVal));
+ 	if(sdbuf[i] != '"') {
+ 		ABORT_FINALIZE(RS_RET_STRUC_DATA_INVLD);
+@@ -281,6 +282,7 @@ parseSD_PARAM(instanceData *const pData, uchar *sdbuf, int lenbuf, int *curridx,
+ 
+ 	*curridx = i;
+ finalize_it:
++	free(pVal);
+ 	RETiRet;
+ }
+ 
diff --git a/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch b/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch
new file mode 100644
index 000000000..fa12bbf88
--- /dev/null
+++ b/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch
@@ -0,0 +1,41 @@
+From: Rainer Gerhards <[email protected]>
+Date: Sun, 8 Jun 2025 13:04:04 +0200
+Subject: omfwd regression fix: avoid false active target change log message
+
+Commit ffaf6dc4620da added proper variable sync, but dropped the check
+if active count had actually changed. As such, the output was always
+generated, which could pollute the log heavily.
+
+Code style fixes where dropped for the backport.
+
+(cherry picked from commit d6d340aaad6ea414a2fd4cf07d3f98c5c9334194)
+---
+ tools/omfwd.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/omfwd.c b/tools/omfwd.c
+index f4f1fdd..4e81461 100644
+--- a/tools/omfwd.c
++++ b/tools/omfwd.c
+@@ -1146,15 +1146,17 @@ countActiveTargets(const wrkrInstanceData_t *const pWrkrData) {
+ 		oldVal = ATOMIC_FETCH_32BIT(&pWrkrData->pData->nActiveTargets,
+ 			&pWrkrData->pData->mut_nActiveTargets);
+ 		if (oldVal == activeTargets) {
+-			break;  // No change needed
++			break;  /* no change, so no log message either */
+ 		}
+ 		newVal = activeTargets;
+ 	} while (!ATOMIC_CAS(&pWrkrData->pData->nActiveTargets, oldVal, newVal,
+ 			&pWrkrData->pData->mut_nActiveTargets));
+ 
+-	LogMsg(0, RS_RET_DEBUG, LOG_DEBUG,
+-		"omfwd: [wrkr %u] number of active targets changed from %d to %d",
+-		pWrkrData->wrkrID, oldVal, activeTargets);
++	if(oldVal != activeTargets) {
++		LogMsg(0, RS_RET_DEBUG, LOG_DEBUG,
++			"omfwd: [wrkr %u] number of active targets changed from %d to %d",
++			pWrkrData->wrkrID, oldVal, activeTargets);
++	}
+ }
+ 
+ 
diff --git a/debian/patches/rainerscript-align-replace-sizing-rewind.patch b/debian/patches/rainerscript-align-replace-sizing-rewind.patch
new file mode 100644
index 000000000..4eda136ea
--- /dev/null
+++ b/debian/patches/rainerscript-align-replace-sizing-rewind.patch
@@ -0,0 +1,43 @@
+From: Rainer Gerhards <[email protected]>
+Date: Thu, 20 Aug 2026 15:53:16 +0200
+Subject: rainerscript: align replace sizing rewind
+
+Why:
+The sizing pass skipped a candidate match that the copy pass replaced.
+
+Impact:
+Overlapping partial matches now receive a correctly sized output string.
+
+Before/After:
+Before, the two passes resumed at different source offsets; after, both
+resume at the same offset.
+
+Technical Overview:
+Make the sizing pass rewind both its source index and tentative output
+length by the full failed partial-match length. This mirrors the copy pass
+and ensures that every replacement counted is also written exactly once.
+The change preserves the existing empty-find, replacement, and trailing
+partial-match behavior.
+
+With the help of AI-Agents: Codex
+
+(cherry picked from commit 667e3f61aec5ee02c5c2ee6f0f8accf6fe4301a9)
+---
+ grammar/rainerscript.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grammar/rainerscript.c b/grammar/rainerscript.c
+index 88c47e5..037b3f6 100644
+--- a/grammar/rainerscript.c
++++ b/grammar/rainerscript.c
+@@ -1761,8 +1761,8 @@ doFuncReplace(struct svar *__restrict__ const operandVal, struct svar *__restric
+ 		if (src_buff[i] == find[j]) {
+ 			j++;
+ 		} else if (j > 0) {
+-			i -= (j - 1);
+-			lDst -= (j - 1);
++			i -= j;
++			lDst -= j;
+ 			j = 0;
+ 		}
+ 	}
diff --git a/debian/patches/series b/debian/patches/series
index 85d824260..f2b4664b5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,7 @@
 Don-t-create-a-database.patch
 Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch
 Revert-queue-emit-better-warning-messages-on-queue-param-.patch
+omfwd-regression-fix-avoid-false-active-target-change-log.patch
+imptcp-guard-regex-framing-match-at-line-start.patch
+rainerscript-align-replace-sizing-rewind.patch
+mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEECbOsLssWnJBDRcxUauHfDWCPItwFAmqTeJoFAwAAAAAACgkQauHfDWCPItz1
gA/+N2PD25pFouDyVIbqU5xZe09bnYaZhL3OlFMOIeiKVNiLmZHFDKgU0+iIqXwmSsDg2ED1sh9u
0a9c0ECyQfheiTZCzBDa6jl6oZChRVzet35W3d6eepJztmVIDdS3z20JBQtd4Q1HBfCJdV5Wbhyz
5UPPbvmllH2F1/K859v5ouUsRxkmHz5ZA+uFT+CYDa2FDfWt6HjvpjF1vP6LUvPWIcKNkNzKmkzs
nzlGjc9oB6k6s3MKygDe5KHODDRQkKaC0K4eQaIyh2LnNX/kBWgHJz5m01XU71djDkgdzezWHbsf
pha//N/a/3OfAlpwZQJ8VhV0OsQsJvaaP9Rqio/vZL9Xc0bro9ecfDfi9Yml+FSzxrFa1SNOS2A9
liV9W4XqhbMKaOCYRu7DfCfkwvSB2atjgv/chprtNLrk5XKiZUgUpDEwVoQyEvw/nhLrURiQV4Bl
ZC+h6PM+oBO1XuA3hmYPT+qn6nkmriXFLRmKTjpM5/8ieLVopjAe/DhYR7ehgW7EfTcVIyqXm1lH
irLLEgorlF8ghJHezafkYT1k68/jUDot0RQygI+nIurLsfhcLM0LhkSDjyaMNca66Rip0aTVsAqE
KnC09sYMaTkkAwzn/6OIhH59nGg3hBtkUmX8a7rywEmIclh9aIJfBVQd68OD0NqWDSlB3DRN5F76
aBM=
=9v/B
-----END PGP SIGNATURE-----