Re: Syslog bug

[ludo@gnu.org (Ludovic Courtès)]

[-- Attachment #1: Type: text/plain, Size: 491 bytes --]

Alex Kost <alezost@gmail.com> skribis:

> Wow, I admire how deep you dig!  Your patch does some funny thing, it
> "moves" corruption to another place.  Here is the output:
>
> # ./syslogd --debug --rcfile /tmp/syslog-with-leading-spaces.conf
> init
> cfline(*.alert;auth.notice;authpriv.none       /dev/console
> sole)

Oops, indeed, I had it too but hadn’t noticed.  :-)

This is because the bcopy call didn’t copy the trailing zero, which is
fixed by adding “+ 1”:


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: Type: text/x-patch, Size: 407 bytes --]

diff --git a/src/syslogd.c b/src/syslogd.c
index 7af10f3..aaf02a4 100644
--- a/src/syslogd.c
+++ b/src/syslogd.c
@@ -1971,7 +1971,7 @@ load_conffile (const char *filename, struct filed **nextp)
       if (*p == '\0' || *p == '#')
 	continue;
 
-      strcpy (cline, p);
+      bcopy (p, cline, strlen (p) + 1);
 
       /* Cut the trailing spaces.  */
       for (p = strchr (cline, '\0'); isspace (*--p);)

[-- Attachment #3: Type: text/plain, Size: 753 bytes --]


> --- a/src/syslogd.c
> +++ b/src/syslogd.c
> @@ -1971,7 +1971,7 @@ load_conffile (const char *filename, struct filed **nextp)
>        if (*p == '\0' || *p == '#')
>  	continue;
>  
> -      strcpy (cline, p);
> +      strncpy (cline, p, strlen (cline));

I guess this worked by chance: it does not copy the trailing zero, and
it doesn’t address the overlapping-memory-regions issue.

> A side note: compilation of inetutils failed for me complaining about
> missing "help2man".  It finished successfully after I had added
> "help2man" to native-inputs.

That’s because the patch modifies the source of an executable for which
a man page is generated.

Thanks for your feedback!  I’ll report the issue upstream.

Ludo’.