[net.unix-wizards] bug in syslog

mrose%uci-750a@sri-unix.UUCP (01/19/84)

From:  Marshall Rose <mrose@uci-750a>

Description:
    If the format string you give to syslog() contains a '%' escape
    other than a '%m', then the format string is truncated after that
    escape and the resulting output in the syslog file looks very wierd.
    This bug makes syslog() virtually useless if you like to put lots
    of information in a single line.

Repeat-By:
    Run the following program, wait a while for some other process to send
    something to the syslog daemon, and then check out the file.
    You'll see something like this:

Jan 17 17:39:12 localhost: 4222 foo: argc=1<8>4231 sendmail: connected to uci-750b

    Note how the syslog daemon got real confused on that one...

#include <syslog.h>

main (argc, argv)
char **argv;
{
    openlog ("foo", LOG_PID);
    syslog (LOG_INFO, "argc=%d *argv=%s", argc, *argv);
}

Fix:
    The code that expands '%m' in the source format string prematurely embeds
    a null in the target format string.  The solution is not to do this
    (obviously).  Actually, a better fix would be to make the daemon
    work correctly regardless of the message that it received.  That's
    not done here though.

*** _syslog.c	Tue Jan 17 17:27:49 1984
--- syslog.c	Tue Jan 17 17:27:55 1984
***************
*** 70,76
  			}
  			c = *f++;
  			if (c != 'm') {
! 				*b++ = '%', *b++ = c, *b++ = '\0';
  				continue;
  			}
  			if ((unsigned)errno > sys_nerr)

--- 70,76 -----
  			}
  			c = *f++;
  			if (c != 'm') {
! 				*b++ = '%', *b++ = c;
  				continue;
  			}
  			if ((unsigned)errno > sys_nerr)

eric%ucbarpa%berkeley@sri-unix.UUCP (02/03/84)

From:  Eric Allman <eric%ucbarpa@berkeley>

For some reason that I do not understand at all, someone created a
new version of syslog which was installed into libc.  This version
has several problems -- I recommend chucking it completely.  The
version in .../sendmail/lib/syslog.c works fine (to the best of
my knowledge).

eric

rusty@sdccsu3.UUCP (03/08/84)

there is a bug in syslog(3) that causes lines containing %C where
C isn't 'm' to screw up. syslog(3) is null terminating the string
incorrectly. diffs follow:

*** /src/lib/libc/gen/syslog.c	Mon Jun 27 15:06:44 1983
--- syslog.c	Wed Mar  7 17:01:37 1984
***************
*** 70,76
  			}
  			c = *f++;
  			if (c != 'm') {
! 				*b++ = '%', *b++ = c, *b++ = '\0';
  				continue;
  			}
  			if ((unsigned)errno > sys_nerr)

--- 70,76 -----
  			}
  			c = *f++;
  			if (c != 'm') {
! 				*b++ = '%', *b++ = c;
  				continue;
  			}
  			if ((unsigned)errno > sys_nerr)

Satz%sri-tsc@sri-unix.UUCP (03/12/84)

From:  Greg Satz <Satz@sri-tsc>


Depending on the log message level, syslog(8) might try to wall a
message to the list of users in /etc/syslog.conf or to all of the
logged in users.  Each forked process winds up hanging instead of
sending the message.  The gethostname() call has the second argument
passed as an address instead of by value.

Because of some large mailing lists, syslog dumped core unless MAXLINE
was increased.

My version of syslog has some fixes that allow it to run under 2.9
(4.1a).  Drop me a note if you are interested.

*** /tmp/,RCSt1013071	Sun Mar 11 17:57:59 1984
--- syslog.c	Fri Feb 24 10:36:59 1984
***************
*** 30,36
  
  # define	NLOGS		10	/* max number of log files */
  # define	NSUSERS		10	/* max number of special users */
! # define	MAXLINE		256	/* maximum line length */
  
  # define	LOGHOSTNAME	1	/* log hostid on each line */
  

--- 30,36 -----
  
  # define	NLOGS		10	/* max number of log files */
  # define	NSUSERS		10	/* max number of special users */
! # define	MAXLINE		1024	/* maximum line length */
  
  # define	LOGHOSTNAME	1	/* log hostid on each line */
***************
*** 958,964
  #ifdef LOG_IPC
  	extern char *gethostname();
  	char hbuf[32];
- 	auto int hlen;
  #endif LOG_IPC
  
  	/* open the user login file */

--- 969,974 -----
  #ifdef LOG_IPC
  	extern char *gethostname();
  	char hbuf[32];
  #endif LOG_IPC
  
  	/* open the user login file */
***************
*** 1021,1028
  		strcpy(sbuf, "\r\n\007Broadcast message from ");
  #ifdef LOG_IPC
  		strcat(sbuf, "syslog@");
! 		hlen = sizeof hbuf;
! 		gethostname(hbuf, &hlen);
  		strcat(sbuf, hbuf);
  #else LOG_IPC
  		strcat(sbuf, sysname);

--- 1036,1042 -----
  		strcpy(sbuf, "\r\n\007Broadcast message from ");
  #ifdef LOG_IPC
  		strcat(sbuf, "syslog@");
! 		gethostname(hbuf, sizeof hbuf);
  		strcat(sbuf, hbuf);
  #else LOG_IPC
  		strcat(sbuf, sysname);