Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 764 of 796  Not logged in ELOG logo
ID Date Icon Author Author Email Categorydown OS ELOG Version Subject
  948   Wed Feb 16 08:48:52 2005 Smile Emiliano GabrielliAlberT@SuperAlberT.itBug fixAll2.5.6 cvsRe: [patch]: fixed wrong extention check
> > current version uses strstr() to check if the file has the expected ascii 
> > text extension ... this is buggy becouse this way a file named 
> > ".txt_hidden_file" or "foo.config.dat" are both seen as .txt files. 
>  
> I added your routine chkext() to the code, but actually use it differently. I 
> display now ASCII files not by their extension, but the code checks for each file 
> to contain non-printable characters. If it contains all printable letters, and does 
> not have the extension PDF, PS or EPS, it's shown inline. 
 
I totally agree with you choice :-) 
  953   Sat Feb 19 18:39:52 2005 Entry Heiko Scheith.scheit@mpi-hd.mpg.deBug fixLinux2.5.7Problem with 'Show Attributes' option
There is a problem with the 'Show Attributes' option
causing the 'Format ...' options to be ignored.

See attachment for patch.
  954   Sun Feb 20 15:30:04 2005 Reply Stefan Rittstefan.ritt@psi.chBug fixLinux2.5.7Re: Problem with 'Show Attributes' option
> There is a problem with the 'Show Attributes' option
> causing the 'Format ...' options to be ignored.
> 
> See attachment for patch.

Thanks a lot. I applied your patch and committed the changes to CVS.
  1072   Mon Apr 11 13:52:29 2005 Warning Heiko Scheith.scheit@mpi-hd.mpg.deBug fixLinux2.5.7-1Segmentation fault when searching for empty regex
Segmentation fault when searching for empty regex
--------------------------------------------------

Searching for a regex like 'm*', which also includes zero 'm's, an empty
expression is found indefinitely in 'highlight_searchtext(...)', which 
eventually results in an overflow of 'pt1'.  The patch below fixes this
particular problem, but I would guess there are many other regular 
expressions that would lead to an overflow of 'pt1', so its size
should definitely be checked before every 'strcpy(pt1,...)' and
the loop be aborted accordingly.  (Or 'pt1' should be allocated 
and enlarged dynamically.)

*** 14777,14782 ****
--- 14777,14784 ----
        if (status != REG_NOMATCH) {
           size = pmatch[0].rm_so;
  
+        if (size == 0) break; /* check for zero size -> infinite loop */
+ 
           /* copy first part original text */
           memcpy(pt1, pt, size);
           pt1 += size;
***************
*** 14788,14795 ****
--- 14790,14799 ----
           /* see also rsputs2(char* ) */
  
           if (hidden)
+          /* need to check size of pt1 !!! */
              strcpy(pt1,
"\001B\004style=\003color:black;background-color:#ffff66\003\002");
           else
+          /* need to check size of pt1 !!! */
              strcpy(pt1, "<B style=\"color:black;background-color:#ffff66\">");
  
           pt1 += strlen(pt1);
***************
*** 14802,14814 ****
--- 14806,14821 ----
  
           /* add coloring 2nd part */
           if (hidden)
+          /* need to check size of pt1 !!! */
              strcpy(pt1, "\001/B\002");
           else
+          /* need to check size of pt1 !!! */
              strcpy(pt1, "</B>");
           pt1 += strlen(pt1);
        }
     } while (status != REG_NOMATCH);
  
+    /* need to check size of pt1 !!! */
     strcpy(pt1, pt);
  }
  1075   Mon Apr 11 21:22:25 2005 Reply Stefan Rittstefan.ritt@psi.chBug fixLinux2.5.7-1Re: Segmentation fault when searching for empty regex
I applied a similar fix like you proposed, just omit highlighting at all if I get a
zero length match. Changes committed to CVS.
  1220   Mon Jun 27 15:37:25 2005 Agree Emiliano GabrielliAlberT@SuperAlberT.itBug fixLinux2.6.0beta2Re: [BUG] quick filter

Emiliano Gabrielli wrote:

Stefan Ritt wrote:


Fixed in current CVS.


uhm... now the drop down menu is composed of only blancs ..


the following patch should solve the problem Wink
--- src/elogd.c 24 Jun 2005 20:22:33 -0000      1.685
+++ src/elogd.c 27 Jun 2005 13:34:05 -0000
@@ -15853,7 +15853,7 @@
                      if (comment[0] == 0)
                         strcpy(comment, attr_options[i][j]);

-                     for (i1=i2=0 ; i1<=(int)comment ; i1++) {
+                     for (i1=i2=0 ; i1<=(int)strlen(comment) ; i1++) {
                         if (comment[i1] == '(') {
                            option[i2++] = '\\';
                            option[i2++] = '(';
  1259   Mon Jul 11 19:04:38 2005 Warning Heiko Scheith.scheit@mpi-hd.mpg.deBug fixLinux2.5.9elog utility for submission used wrong 'Host:' in POST header
The 'elog' utility for commandline submission used wrong 'Host:' in POST header.
The host listed after 'Host:' should be the host where the server runs, not the 
localhost (see patch below).

$ diff -u elog.c_20050711  elog.c
--- elog.c_20050711     Mon Jul 11 18:54:20 2005
+++ elog.c      Mon Jul 11 18:55:31 2005
@@ -421,7 +421,7 @@
       sprintf(request + strlen(request), "%s/%d?cmd=download", experiment, message_id);
    strcat(request, " HTTP/1.0\r\n");
 
-   sprintf(request + strlen(request), "Host: %s\r\n", host_name);
+   sprintf(request + strlen(request), "Host: %s\r\n", host);
    sprintf(request + strlen(request), "User-Agent: ELOG\r\n");
 
    first = 1;
@@ -872,7 +872,7 @@
    strcat(request, " HTTP/1.0\r\n");
 
    sprintf(request + strlen(request), "Content-Type: multipart/form-data; boundary=%s\r\n", boundary);
-   sprintf(request + strlen(request), "Host: %s\r\n", host_name);
+   sprintf(request + strlen(request), "Host: %s\r\n", host);
    sprintf(request + strlen(request), "User-Agent: ELOG\r\n");
    sprintf(request + strlen(request), "Content-Length: %d\r\n", content_length);
  1260   Tue Jul 12 10:15:30 2005 Warning Emiliano GabrielliAlberT@SuperAlberT.itBug fixLinux2.5.9Re: elog utility for submission used wrong 'Host:' in POST header
> The 'elog' utility for commandline submission used wrong 'Host:' in POST header.
> The host listed after 'Host:' should be the host where the server runs, not the
> localhost (see patch below).
>
> $ diff -u elog.c_20050711 elog.c
> --- elog.c_20050711 Mon Jul 11 18:54:20 2005
> +++ elog.c Mon Jul 11 18:55:31 2005
> @@ -421,7 +421,7 @@
> sprintf(request + strlen(request), "%s/%d?cmd=download", experiment, message_id);
> strcat(request, " HTTP/1.0\r\n");
>
> - sprintf(request + strlen(request), "Host: %s\r\n", host_name);
> + sprintf(request + strlen(request), "Host: %s\r\n", host);
> sprintf(request + strlen(request), "User-Agent: ELOG\r\n");
>
> first = 1;
> @@ -872,7 +872,7 @@
> strcat(request, " HTTP/1.0\r\n");
>
> sprintf(request + strlen(request), "Content-Type: multipart/form-data; boundary=%s\r\n", boundary);
> - sprintf(request + strlen(request), "Host: %s\r\n", host_name);
> + sprintf(request + strlen(request), "Host: %s\r\n", host);
> sprintf(request + strlen(request), "User-Agent: ELOG\r\n");
> sprintf(request + strlen(request), "Content-Length: %d\r\n", content_length);

This is not completally true IMHO .. better, it is, but it is not the only problem.

Elog seems to speak HTML/1.0, where "host:" is not implemented ... Since ELOG does not support Vhosts I think the right beaviour is to remove the "Host:" header at all ...

On the other hand it should replay with an error when a bogus client tries to speak HTML/1.0 specifing "host:",
and (the wrost case) when the bogus client says to speak HTML/1.1 and doesnt provide the required "Host:" header ...
Yes .. elog will ignore it, but it is an RFC requirement for HTML/1.1 !
ELOG V3.1.5-2eba886