Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG  Not logged in ELOG logo
icon4.gif   Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Fri Nov 21 10:53:09 2008 
    icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Fri Nov 21 16:02:10 2008 
       icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Stefan Ritt on Mon Nov 24 18:15:01 2008 
          icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Thu Nov 27 10:29:19 2008 
          icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Fri Jan 9 10:41:20 2009 
             icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Tue Jan 13 14:30:37 2009 
                icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Stefan Ritt on Wed Jan 21 08:45:25 2009 
                   icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Wed Mar 4 16:32:56 2009 
                      icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Stefan Ritt on Wed Mar 4 16:41:27 2009 
Message ID: 66086     Entry time: Thu Nov 27 10:29:19 2008     In reply to: 66077
Icon: Reply  Author: Niklas  Author Email: niklas@hoglund.pp.se 
Category: Bug report  OS: Linux  ELOG Version: 2.7.5 2142 
Subject: Re: Elogd crashes with: *** stack smashing detected *** 

Stefan Ritt wrote:

 

Niklas wrote:

 

Stefan,

perhaps there should be something like the bold text below in elogd.c:

int process_http_request(const char *request, int i_conn)^M
...

   /* extract cookies */^M
   if ((p = strstr(request, "Cookie:")) != NULL) {^M
      p += 6;^M
      do {^M
         p++;^M
         while (*p && *p == ' ')^M
            p++;^M
         strlcpy(str, p, sizeof(str));^M
         for (i = 0; i < (int) strlen(str); i++)^M
            if (str[i] == '=' || str[i] == ';')^M
               break;^M
         if (str[i] == '=') {^M
            str[i] = 0;^M
            p += i + 1;^M
            for (i = 0; *p && *p != ';' && *p != '\r' && *p != '\n' && i < (int) sizeof(cookie); i++)
                      cookie[i] = *p++;

...

 

Wow, where did you get that long cookie from? Certainly not from elogd. You must run elogd under Apache, and have some other service next to it on your server which distributes this long cookies, that's why other people did not experience this problem yet. I appreciate your fix. It's alwasy nice to see users not only complain about things, but try to fix them. Your fix is almost correct, you need a

i<(int) sizeof(cookie)-1

since there is the trailing zero for terminating the cookie string. I applied your fix to SVN revision #2146.

I the cookie is used for single-sign-on for multiple sites within company.com. So the cookie is issued for "company.com" i.e. all websites gets it even elog.company.com:8080..

I mostly fibble little bit in perl (dont need to bother with trailing zeros there ).

BR, Niklas

 

 

ELOG V3.1.5-fe60aaf