From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/2954 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Further bugs in syslog() Date: Fri, 22 Mar 2013 23:45:39 -0400 Message-ID: <20130323034538.GS20323@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1364010356 11399 80.91.229.3 (23 Mar 2013 03:45:56 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 23 Mar 2013 03:45:56 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-2955-gllmg-musl=m.gmane.org@lists.openwall.com Sat Mar 23 04:46:23 2013 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1UJFPN-0007yC-Ha for gllmg-musl@plane.gmane.org; Sat, 23 Mar 2013 04:46:17 +0100 Original-Received: (qmail 23673 invoked by uid 550); 23 Mar 2013 03:45:52 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 23665 invoked from network); 23 Mar 2013 03:45:52 -0000 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:2954 Archived-At: Hi all, William Haddon's report about syslog prompted me to review the file, and there seem to be several additional bugs: 1. log_ident stores the actual pointer passed by the caller rather than a copy of the string. This probably works in practice for most callers but it's definitely not correct. 2. As a specific case of the previously reported bug, overflows will happen if log_ident is too long. This is unlikely to happen intentionally, but could happen if log_ident points to storage on the stack whose lifetime ended and which was subsequently reused. 3. Opening the log fd with LOG_NDELAY only obtains the socket, but does not connect it. The socket is a datagram socket, so connect is not needed to use it, but if sendto is used instead of connect, the idiom of using openlog with LOG_NDELAY before chroot will not work. I'm going to review the proposed patches and probably put together a big syslog fix... Rich