Hi,
I've spent the half night staring at the devilish my_getpwuid and my_getgrgid functions
trying to find out a way to avoid actual and future potential buffer overflow problems
without breaking existing code.
Finally I've found a not intrusive way to do this that surely doesn't break existing code
and fixes a couple of problems too.
The attached patch:
1) changes the behaviour of my_getpwuid and my_getgrgid to avoid potetntial buffer overflows
2) fixes all occurences of this function calls in tar.c , id.c , ls.c, whoami.c, logger.c, libbb.h.
3) The behaviour of tar, ls and logger is unchanged.
4) The behavior of ps with somewhat longer usernames messing up output is fixed.
5) The only bigger change was the increasing of size of the buffers in id.c to avoid
false negatives (unknown user: xxxxxx) with usernames longer than 8 chars.
The value i used ( 32 chars ) was taken from the tar header ( see gname and uname).
Maybe this buffers can be reduced a bit ( to 16 or whatever ), this is up to you.
6) The increase of size of the binary is not so dramatic:
size busybox
text data bss dec hex filename
239568 2300 36816 278684 4409c busybox
size busybox_fixed
text data bss dec hex filename
239616 2300 36816 278732 440cc busybox
7) The behaviour of whoami changed:
actually it prints out an username cut down to the size of the buffer.
This could be fixed by increasing the size of the buffer as in id.c or
avoid the use of my_getpwuid and use getpwuid directly instead.
Maybe this colud be also remain unchanged......
Please apply if you think it is ok to do so.
The diff applies on today's cvs tarball (2004-08-25).
Thanks in advance,
Ciao,
Tito
Hi folks
The following patch adds a new log message output to syslogd. This
output omits hostname and priority and is used in d-i to make the syslog
output better readable without lossing information.
Bastian
I am applying this since I have syslogd hacked up in my wife's
access point with the same format string.... Might as well make
this hack official.
-Erik
On Sat, Jun 19, 2004 at 10:57:37PM +0200, Bastian Blank wrote:
> The following patch changes klogd to use openlog/syslog themself
> instead of calling syslog_msg which always calls the triple
> openlog/syslog/closelog.
Updated patch: get rid of syslog_msg entirely. Request from Erik Andersen.
Bastian
This is a bulk spelling fix patch against busybox-1.00-pre10.
If anyone gets a corrupted copy (and cares), let me know and
I will make alternate arrangements.
Erik - please apply.
Authors - please check that I didn't corrupt any meaning.
Package importers - see if any of these changes should be
passed to the upstream authors.
I glossed over lots of sloppy capitalizations, missing apostrophes,
mixed American/British spellings, and German-style compound words.
What is "pretect redefined for test" in cmdedit.c?
Good luck on the 1.00 release!
- Larry
You will find in the attached file "syslog.patch" a patch which adds
config options to set at compile time the size of the circular buffer,
and some documentation update.
the busybox menuconfig triggered my "inacceptable number of spelling mistakes"
upper level, so I decided to make a patch ;-)
I also improved some wording to describe some things in a better way.
Many thanks for an incredible piece of software!
Andreas Mohr, random OSS developer
Hi Eric
I have written a small patch for the Busybox syslogd. With this patch
one can limit the size of the messagfile. As soon as the limit is
reached the syslogd can rotate or purge the messagefile(s) on his own.
There is no necessity to use an external rotatescript.
Even if logread does something similar, its very handy to have some
messagefile after your box crash.
I wrote this patch initial vor BB 0.6x where no cron daemon was avail.
Now I adapted it for the new Version and i hope it is still useful. At
least I still use it :-)
bye
Arnd
Add follow mode to logread, ala "tail -f /var/log/messages"
Note: output to a slow serial terminal can have side effects
on syslog because of the semaphore. In such case, define
RC_LOGREAD.
Hi.
Last patch have new libbb function
vfork_rexec() for can use daemon() to uClinux system.
This patched daemons: syslog, klogd, inetd, crond.
This not tested! I havn`t this systems.
Also. Previous patch for feature request MD5 crypt password for
httpd don`t sended to this mailist on 07/15/03
(mailist have Pytom module problem?).
The previous patch included, and have testing.
--w
vodz
'>' charactor can be logged, per rfc3164.
Also, a small patch from me to fix it so we use MAXLINE when allocating the
buffer, which is consistant with use everywhere else. This is needed since
uClibc defines BUFSIZE as 255, causing lines to be truncated at 255...
modified Kbuild system I put into uClibc. With this, there should be no more
need to modify Rules.mak since I've moved all the interesting options into the
config system. I think I've got everything updated, but you never know, I may
have made some mistakes, so watch closely.
-Erik
Hi, Erik.
my_getpw(uid/gid) and applets used it have problem:
if username for uid not found, applets can`t detect it
(but code pessent). Also "%8ld " format is bad:
spaces not required (applets have self format
or spec format (tar applet) and overflow for "id" applet...)
This problem also pressent in stable version.
Patch for unstable in attach.
--w
vodz
Ok. Patch with reduce size ready.
Notes: syslogd imposible close logsocket,
the real programm write logmessages (hmm, cycle loop?)
(Excuse me - this have small tab-formats rewroting also)
text data bss dec hex filename
2913 332 12388 15633 3d11 syslogd.o
3109 332 9252 12693 3195 syslogd_old.o
change in uClibc that changed opening the /dev/log socket as
SOCK_STREAM to SOCK_DGRAM, busybox syslogd no longer worked
since it needed a matching change. This fixes it so it
works once again.
I am using BB 0.60.2 in a floppy distro, and the syslog (and logger) is
unable to log the "<" char. This shows up in ppp logfiles. [...]
#logger "<pcomp>" results in "comp>" arriving at the log.
the busybox development tree. This eliminates the use of recursive make, and
once again allows us to run 'make' in a subdirectory with the expected result.
And things are now much faster too. Greatly improved IMHO...
-Erik
