Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG  Not logged in ELOG logo
icon4.gif   Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Fri Nov 21 10:53:09 2008 
    icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Fri Nov 21 16:02:10 2008 
       icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Stefan Ritt on Mon Nov 24 18:15:01 2008 
          icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Thu Nov 27 10:29:19 2008 
          icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Fri Jan 9 10:41:20 2009 
             icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Tue Jan 13 14:30:37 2009 
                icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Stefan Ritt on Wed Jan 21 08:45:25 2009 
                   icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Niklas on Wed Mar 4 16:32:56 2009 
                      icon2.gif   Re: Elogd crashes with: *** stack smashing detected ***, posted by Stefan Ritt on Wed Mar 4 16:41:27 2009 
Message ID: 66234     Entry time: Wed Mar 4 16:32:56 2009     In reply to: 66163     Reply to this: 66235
Icon: Reply  Author: Niklas  Author Email: niklas@hoglund.pp.se 
Category: Bug report  OS: Linux  ELOG Version: 2.7.5 2142 
Subject: Re: Elogd crashes with: *** stack smashing detected *** 

Stefan Ritt wrote:

 

Niklas wrote:

Create a list of elog cookies, and store only these as parameters. Examplef:

int process_http_request(const char *request, int i_conn)

{
...
const char *cookie_list[] = { "upwd", "unm", "elmode", "urem", "wpwd", "apwd", "uname", NULL };
...
...
...
         /* store cookie as parameter */
         for(i=0; cookie_list[i]; i++) {
            if(strcmp(cookie_list[i], str) == 0) {
               setparam(str, cookie);
               break;
            }
         }

...

 

I'm not sure if this works, since your test

i < (int) sizeof(cookie)

still will stop parsing cookies if there is one which is too long. So I added your test plus changed the parsing to:

for (i = 0; *p && *p != ';' && *p != '\r' && *p != '\n' ; )

   if (i < (int) sizeof(cookie)-1)

      cookie[i++] = *p++;

   cookie[i] = 0;

 


The modification is in the curren SVN revision (# 2162). So have a look and check that it works.

Tried 2178 and I seem to hit some endless loop when I have big cookies. The loop seems to be in this for-loop (from gdb).

I perhaps you should have:

for (i = 0; *p && *p != ';' && *p != '\r' && *p != '\n' ; )

   if (i < (int) sizeof(cookie)-1)

      cookie[i++] = *p++;

   else
      break;

   cookie[i] = 0;

... Seems to be working for me =)

 

ELOG V3.1.5-3fb85fa6