mirrors/musl
1
0
Fork 0
mirror of https://git.musl-libc.org/git/musl synced 2025-01-06 23:02:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

syslog: use C locale for timestamp generation

Browse Source 
depending on contents of the LC_TIME locale, log messages could be
malformatted (especially if the ABMON strings contain non-alphabetic
characters) or the subsequent code could invoke undefined behavior,
via passing a timebuf[] with unspecified contents to snprintf, if
the translated ABMON string did not fit in the 16-byte timebuf.

this does not appear to be a security-relevant bug, as locale loading
functionality is intentionally not available to set*id programs -- the
MUSL_LOCPATH environment variable is ignored when libc.secure is true,
and custom locales are not loadable without it.
This commit is contained in:
Rich Felker 2024-02-07 16:08:11 -05:00
parent 8b70486807
commit 39838619bb
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/misc/syslog.c
View File

@ -11,6 +11,7 @@
#include <fcntl.h>
#include "lock.h"
#include "fork_impl.h"
#include "locale_impl.h"
static volatile int lock[1];
static char log_ident[32];
@ -99,7 +100,7 @@ static void _vsyslog(int priority, const char *message, va_list ap)
now = time(NULL);
gmtime_r(&now, &tm);
strftime(timebuf, sizeof timebuf, "%b %e %T", &tm);
strftime_l(timebuf, sizeof timebuf, "%b %e %T", &tm, C_LOCALE);
pid = (log_opt & LOG_PID) ? getpid() : 0;
l = snprintf(buf, sizeof buf, "<%d>%s %n%s%s%.0d%s: ",