Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 774 of 806  Not logged in ELOG logo
New entries since:Thu Jan 1 01:00:00 1970
icon3.gif   [patch]: fixed wrong extention check, posted by Emiliano Gabrielli on Tue Feb 8 17:40:54 2005 
current version uses strstr() to check if the file has the expected ascii
text extension ... this is buggy becouse this way a file named
".txt_hidden_file" or "foo.config.dat" are both seen as .txt files.

the following patch fixes the problem, plz apply to cvs:



#######################################################################
--- elogd_orig.c        2005-02-03 16:46:10.000000000 +0100
+++ elogd_extchk_fix.c  2005-02-08 17:32:21.000000000 +0100
@@ -1160,6 +1160,28 @@

 #define my_toupper(_c)    ( ((_c)>='a' && (_c)<='z') ? ((_c)-'a'+'A') : (_c) )

+static BOOL chkext(const char *str, const char *ext)
+{
+   int extl, strl;
+   char c1, c2;
+
+   if (ext == NULL || str == NULL)
+      return FALSE;
+
+   extl = strlen(ext);
+   strl = strlen(str);
+   if (extl >= strl)
+      return FALSE;
+   str = str+strl-extl;
+   while (*str) {
+      c1 = *str++;
+      c2 = *ext++;
+      if (my_toupper(c1) != my_toupper(c2))
+         return FALSE;
+   }
+   return TRUE;
+}
+
 BOOL strieq(const char *str1, const char *str2)
 {
    char c1, c2;
@@ -1168,6 +1190,8 @@
       return TRUE;
    if (str1 == NULL || str2 == NULL)
       return FALSE;
+   if (strlen(str1)!=strlen(str2))
+      return FALSE;

    while (*str1) {
       c1 = *str1++;
@@ -13698,8 +13722,8 @@
                       ("<tr><td colspan=%d class=\"attachment\">%s %d: <a
href=\"%s\">%s</a>\n",
                        colspan, loc("Attachment"), index + 1, ref,
attachment[index] + 14);

-                  if ((strstr(str, ".TXT") || strstr(str, ".ASC") ||
strstr(str, ".CFG")
-                       || strstr(str, ".CONF")
+                  if ((chkext(str, ".TXT") || chkext(str, ".ASC") ||
chkext(str, ".CFG")
+                       || chkext(str, ".CONF")
                        || strchr(str, '.') == NULL) && show_attachments) {
                      /* display attachment */
                      rsprintf("</td></tr><tr><td colspan=%d
class=\"messagelist\"><pre>", colspan);
@@ -14779,7 +14803,7 @@
    regex_t re_buf[MAX_N_ATTR + 1];
    regmatch_t pmatch[10];

-   /* redirect if enpty parameters */
+   /* redirect if empty parameters */
    if (strstr(_cmdline, "=&")) {
       while ((pt1 = strstr(_cmdline, "=&")) != NULL) {
          pt2 = pt1;
#######################################################################
    icon2.gif   Re: [patch]: fixed wrong extention check, posted by Stefan Ritt on Sat Feb 12 17:45:39 2005 
> current version uses strstr() to check if the file has the expected ascii
> text extension ... this is buggy becouse this way a file named
> ".txt_hidden_file" or "foo.config.dat" are both seen as .txt files.

I added your routine chkext() to the code, but actually use it differently. I
display now ASCII files not by their extension, but the code checks for each file
to contain non-printable characters. If it contains all printable letters, and does
not have the extension PDF, PS or EPS, it's shown inline.
    icon7.gif   Re: [patch]: fixed wrong extention check, posted by Emiliano Gabrielli on Wed Feb 16 08:48:52 2005 
> > current version uses strstr() to check if the file has the expected ascii 
> > text extension ... this is buggy becouse this way a file named 
> > ".txt_hidden_file" or "foo.config.dat" are both seen as .txt files. 
>  
> I added your routine chkext() to the code, but actually use it differently. I 
> display now ASCII files not by their extension, but the code checks for each file 
> to contain non-printable characters. If it contains all printable letters, and does 
> not have the extension PDF, PS or EPS, it's shown inline. 
 
I totally agree with you choice :-) 
icon1.gif   Problem with 'Show Attributes' option, posted by Heiko Scheit on Sat Feb 19 18:39:52 2005 patch
There is a problem with the 'Show Attributes' option
causing the 'Format ...' options to be ignored.

See attachment for patch.
    icon2.gif   Re: Problem with 'Show Attributes' option, posted by Stefan Ritt on Sun Feb 20 15:30:04 2005 
> There is a problem with the 'Show Attributes' option
> causing the 'Format ...' options to be ignored.
> 
> See attachment for patch.

Thanks a lot. I applied your patch and committed the changes to CVS.
icon4.gif   Segmentation fault when searching for empty regex, posted by Heiko Scheit on Mon Apr 11 13:52:29 2005 
Segmentation fault when searching for empty regex
--------------------------------------------------

Searching for a regex like 'm*', which also includes zero 'm's, an empty
expression is found indefinitely in 'highlight_searchtext(...)', which 
eventually results in an overflow of 'pt1'.  The patch below fixes this
particular problem, but I would guess there are many other regular 
expressions that would lead to an overflow of 'pt1', so its size
should definitely be checked before every 'strcpy(pt1,...)' and
the loop be aborted accordingly.  (Or 'pt1' should be allocated 
and enlarged dynamically.)

*** 14777,14782 ****
--- 14777,14784 ----
        if (status != REG_NOMATCH) {
           size = pmatch[0].rm_so;
  
+        if (size == 0) break; /* check for zero size -> infinite loop */
+ 
           /* copy first part original text */
           memcpy(pt1, pt, size);
           pt1 += size;
***************
*** 14788,14795 ****
--- 14790,14799 ----
           /* see also rsputs2(char* ) */
  
           if (hidden)
+          /* need to check size of pt1 !!! */
              strcpy(pt1,
"\001B\004style=\003color:black;background-color:#ffff66\003\002");
           else
+          /* need to check size of pt1 !!! */
              strcpy(pt1, "<B style=\"color:black;background-color:#ffff66\">");
  
           pt1 += strlen(pt1);
***************
*** 14802,14814 ****
--- 14806,14821 ----
  
           /* add coloring 2nd part */
           if (hidden)
+          /* need to check size of pt1 !!! */
              strcpy(pt1, "\001/B\002");
           else
+          /* need to check size of pt1 !!! */
              strcpy(pt1, "</B>");
           pt1 += strlen(pt1);
        }
     } while (status != REG_NOMATCH);
  
+    /* need to check size of pt1 !!! */
     strcpy(pt1, pt);
  }
    icon2.gif   Re: Segmentation fault when searching for empty regex, posted by Stefan Ritt on Mon Apr 11 21:22:25 2005 
I applied a similar fix like you proposed, just omit highlighting at all if I get a
zero length match. Changes committed to CVS.
    icon14.gif   Re: [BUG] quick filter, posted by Emiliano Gabrielli on Mon Jun 27 15:37:25 2005 

Emiliano Gabrielli wrote:

Stefan Ritt wrote:


Fixed in current CVS.


uhm... now the drop down menu is composed of only blancs ..


the following patch should solve the problem Wink
--- src/elogd.c 24 Jun 2005 20:22:33 -0000      1.685
+++ src/elogd.c 27 Jun 2005 13:34:05 -0000
@@ -15853,7 +15853,7 @@
                      if (comment[0] == 0)
                         strcpy(comment, attr_options[i][j]);

-                     for (i1=i2=0 ; i1<=(int)comment ; i1++) {
+                     for (i1=i2=0 ; i1<=(int)strlen(comment) ; i1++) {
                         if (comment[i1] == '(') {
                            option[i2++] = '\\';
                            option[i2++] = '(';
ELOG V3.1.5-3fb85fa6