From 52263feef38a567d3243d5fdf990d9ee16e38439 Mon Sep 17 00:00:00 2001
From: Anoop Saldanha <poonaatsoc@gmail.com>
Date: Sun, 27 Dec 2009 00:55:39 +0530
Subject: [PATCH] Fix for buffer overflow logging bug #6

---
 src/util-debug.c |   54 +++++++++++++++++++++++++++++++++++-------------------
 src/util-debug.h |    7 +++++++
 2 files changed, 42 insertions(+), 19 deletions(-)

diff --git a/src/util-debug.c b/src/util-debug.c
index 40b8d1e..9b9e89f 100644
--- a/src/util-debug.c
+++ b/src/util-debug.c
@@ -264,7 +264,7 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
     struct timeval tval;
     struct tm *tms;
 
-    /* no of characters_written(cw) by sprintf */
+    /* no of characters_written(cw) by snprintf */
     int cw = 0;
 
     if (temp_fmt == NULL) {
@@ -292,6 +292,12 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
         return SC_LOG_FG_FILTER_MATCH_FAILED;
 
 	while ( (temp_fmt = index(temp_fmt, SC_LOG_FMT_PREFIX)) ) {
+        if ((temp - *msg) > SC_LOG_MAX_LOG_MSG_LEN) {
+            printf("Warning: Log message exceeded message length limit of %d\n",
+                   SC_LOG_MAX_LOG_MSG_LEN);
+            *msg = *msg + SC_LOG_MAX_LOG_MSG_LEN;
+            return SC_OK;
+        }
         switch(temp_fmt[1]) {
             case SC_LOG_FMT_TIME:
                 temp_fmt[0] = '\0';
@@ -299,7 +305,7 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
                 gettimeofday(&tval, NULL);
                 tms = (struct tm *)localtime(&tval.tv_sec);
 
-                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN,
+                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg),
                               "%s%d/%d/%04d -- %02d:%02d:%02d",
                               substr, tms->tm_mday, tms->tm_mon,
                               tms->tm_year + 1900, tms->tm_hour, tms->tm_min,
@@ -314,8 +320,8 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
 
             case SC_LOG_FMT_PID:
                 temp_fmt[0] = '\0';
-                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN, "%s%u", substr,
-                              getpid());
+                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg),
+                              "%s%u", substr, getpid());
                 if (cw < 0)
                     goto error;
                 temp += cw;
@@ -326,8 +332,8 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
 
             case SC_LOG_FMT_TID:
                 temp_fmt[0] = '\0';
-                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN, "%s%lu", substr,
-                              syscall(SYS_gettid));
+                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg),
+                              "%s%lu", substr, syscall(SYS_gettid));
                 if (cw < 0)
                     goto error;
                 temp += cw;
@@ -339,8 +345,8 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
             case SC_LOG_FMT_TM:
                 temp_fmt[0] = '\0';
                 ThreadVars *tv = TmThreadsGetCallingThread();
-                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN, "%s%s", substr,
-                              ((tv != NULL)? tv->name: "UNKNOWN TM"));
+                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg),
+                              "%s%s", substr, ((tv != NULL)? tv->name: "UNKNOWN TM"));
                 if (cw < 0)
                     goto error;
                 temp += cw;
@@ -353,11 +359,11 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
                 temp_fmt[0] = '\0';
                 s = SCMapEnumValueToName(log_level, sc_log_level_map);
                 if (s != NULL)
-                    cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN, "%s%s", substr,
-                                  s);
+                    cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg),
+                                  "%s%s", substr, s);
                 else
-                    cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN, "%s%s", substr,
-                                  "INVALID");
+                    cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg),
+                                  "%s%s", substr, "INVALID");
                 if (cw < 0)
                     goto error;
                 temp += cw;
@@ -368,8 +374,8 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
 
             case SC_LOG_FMT_FILE_NAME:
                 temp_fmt[0] = '\0';
-                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN, "%s%s", substr,
-                              file);
+                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg),
+                              "%s%s", substr, file);
                 if (cw < 0)
                     goto error;
                 temp += cw;
@@ -380,8 +386,8 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
 
             case SC_LOG_FMT_LINE:
                 temp_fmt[0] = '\0';
-                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN, "%s%d", substr,
-                              line);
+                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg),
+                              "%s%d", substr, line);
                 if (cw < 0)
                     goto error;
                 temp += cw;
@@ -392,8 +398,8 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
 
             case SC_LOG_FMT_FUNCTION:
                 temp_fmt[0] = '\0';
-                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN, "%s%s", substr,
-                              function);
+                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg),
+                              "%s%s", substr, function);
                 if (cw < 0)
                     goto error;
                 temp += cw;
@@ -405,7 +411,7 @@ SCError SCLogMessage(SCLogLevel log_level, char **msg, const char *file,
         }
         temp_fmt++;
 	}
-    cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN, "%s", substr);
+    cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg), "%s", substr);
     if (cw < 0)
         goto error;
 
@@ -1403,6 +1409,15 @@ int SCLogTestInit04()
     return result;
 }
 
+int SCLogTestInit05()
+{
+    int result = 1;
+
+    SCLogInfo("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
+
+    return result;
+}
+
 #endif /* UNITTESTS */
 
 void SCLogRegisterTests()
@@ -1414,6 +1429,7 @@ void SCLogRegisterTests()
     UtRegisterTest("SCLogTestInit02", SCLogTestInit02, 1);
     UtRegisterTest("SCLogTestInit03", SCLogTestInit03, 1);
     UtRegisterTest("SCLogTestInit04", SCLogTestInit04, 1);
+    UtRegisterTest("SCLogTestInit05", SCLogTestInit05, 1);
 
 #endif /* UNITTESTS */
 
diff --git a/src/util-debug.h b/src/util-debug.h
index e3a2bd2..9060a9c 100644
--- a/src/util-debug.h
+++ b/src/util-debug.h
@@ -205,6 +205,13 @@ extern int sc_log_module_cleaned;
                                                "[ERRCODE: %s(%d)] - ",   \
                                                SCErrorToString(err),     \
                                                err);                     \
+                                      if ((_sc_log_err_temp - _sc_log_err_msg) > \
+                                          SC_LOG_MAX_LOG_MSG_LEN) {      \
+                                          printf("Warning: Log message exceeded message length limit of %d\n",\
+                                                 SC_LOG_MAX_LOG_MSG_LEN); \
+                                          _sc_log_err_temp = _sc_log_err_msg + \
+                                              SC_LOG_MAX_LOG_MSG_LEN;    \
+                                      }                                  \
                                       snprintf(_sc_log_err_temp,         \
                                                (SC_LOG_MAX_LOG_MSG_LEN - \
                                                 (_sc_log_err_msg - _sc_log_err_temp)), \
-- 
1.5.5

