From mboxrd@z Thu Jan  1 00:00:00 1970
X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/2951
Path: news.gmane.org!not-for-mail
From: Szabolcs Nagy <nsz@port70.net>
Newsgroups: gmane.linux.lib.musl.general
Subject: Re: Weird bug in syslog
Date: Wed, 20 Mar 2013 19:55:31 +0100
Message-ID: <20130320185531.GM19010@port70.net>
References: <1363721555.2099.0@eros>
 <20130320124125.GL19010@port70.net>
Reply-To: musl@lists.openwall.com
NNTP-Posting-Host: plane.gmane.org
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="k+w/mQv8wyuph6w0"
X-Trace: ger.gmane.org 1363805742 8195 80.91.229.3 (20 Mar 2013 18:55:42 GMT)
X-Complaints-To: usenet@ger.gmane.org
NNTP-Posting-Date: Wed, 20 Mar 2013 18:55:42 +0000 (UTC)
To: musl@lists.openwall.com
Original-X-From: musl-return-2952-gllmg-musl=m.gmane.org@lists.openwall.com Wed Mar 20 19:56:09 2013
Return-path: <musl-return-2952-gllmg-musl=m.gmane.org@lists.openwall.com>
Envelope-to: gllmg-musl@plane.gmane.org
Original-Received: from mother.openwall.net ([195.42.179.200])
	by plane.gmane.org with smtp (Exim 4.69)
	(envelope-from <musl-return-2952-gllmg-musl=m.gmane.org@lists.openwall.com>)
	id 1UIOBC-0002W2-Og
	for gllmg-musl@plane.gmane.org; Wed, 20 Mar 2013 19:56:06 +0100
Original-Received: (qmail 5528 invoked by uid 550); 20 Mar 2013 18:55:43 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
Original-Received: (qmail 5520 invoked from network); 20 Mar 2013 18:55:43 -0000
Content-Disposition: inline
In-Reply-To: <20130320124125.GL19010@port70.net>
User-Agent: Mutt/1.5.21 (2010-09-15)
Xref: news.gmane.org gmane.linux.lib.musl.general:2951
Archived-At: <http://permalink.gmane.org/gmane.linux.lib.musl.general/2951>


--k+w/mQv8wyuph6w0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

syslog fix

proper bounds checks, size_t len and no unlock (wrapper should do it)

--k+w/mQv8wyuph6w0
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="musl-syslog.diff"

diff --git a/src/misc/syslog.c b/src/misc/syslog.c
index 8de34f8..ef8dcfb 100644
--- a/src/misc/syslog.c
+++ b/src/misc/syslog.c
@@ -8,6 +8,7 @@
 #include <signal.h>
 #include <string.h>
 #include <pthread.h>
+#include <limits.h>
 #include "libc.h"
 
 static int lock[2];
@@ -71,14 +72,11 @@ static void _vsyslog(int priority, const char *message, va_list ap)
 	struct tm tm;
 	char buf[256];
 	int pid;
-	int l, l2;
+	size_t l, l2;
 
 	if (log_fd < 0) {
 		__openlog(log_ident, log_opt | LOG_NDELAY, log_facility);
-		if (log_fd < 0) {
-			UNLOCK(lock);
-			return;
-		}
+		if (log_fd < 0) return;
 	}
 
 	now = time(NULL);
@@ -90,14 +88,13 @@ static void _vsyslog(int priority, const char *message, va_list ap)
 		priority, timebuf,
 		log_ident ? log_ident : "",
 		"["+!pid, pid, "]"+!pid);
+	if (l >= sizeof buf) l = sizeof buf - 1;
 	l2 = vsnprintf(buf+l, sizeof buf - l, message, ap);
-	if (l2 >= 0) {
-		l += l2;
-		if (buf[l-1] != '\n') buf[l++] = '\n';
-		sendto(log_fd, buf, l, 0, (void *)&log_addr, 11);
-	}
-
-	UNLOCK(lock);
+	if (l2 > INT_MAX) return;
+	l += l2;
+	if (l >= sizeof buf) l = sizeof buf - 1;
+	if (buf[l-1] != '\n') buf[l++] = '\n';
+	sendto(log_fd, buf, l, 0, (void *)&log_addr, 11);
 }
 
 void __vsyslog(int priority, const char *message, va_list ap)

--k+w/mQv8wyuph6w0--