[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 22 Mar 2013 23:45:39 -0400
From: Rich Felker <dalias@...ifal.cx>
To: musl@...ts.openwall.com
Subject: Further bugs in syslog()
Hi all,
William Haddon's report about syslog prompted me to review the file,
and there seem to be several additional bugs:
1. log_ident stores the actual pointer passed by the caller rather
than a copy of the string. This probably works in practice for most
callers but it's definitely not correct.
2. As a specific case of the previously reported bug, overflows will
happen if log_ident is too long. This is unlikely to happen
intentionally, but could happen if log_ident points to storage on
the stack whose lifetime ended and which was subsequently reused.
3. Opening the log fd with LOG_NDELAY only obtains the socket, but
does not connect it. The socket is a datagram socket, so connect is
not needed to use it, but if sendto is used instead of connect,
the idiom of using openlog with LOG_NDELAY before chroot will not
work.
I'm going to review the proposed patches and probably put together a
big syslog fix...
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
