[chris at ferret.lmh.ox.ac.uk: INN: guilty of syslog() format string breakage?]

[Russ Allbery]

*sigh*  Thanks.  Okay, clearly tonight I need to work on backporting the
setuid/setgid changes to the STABLE-2_2 branch so that we can kick out a
patch release.

Marco d'Itri <md at linux.it> writes:

> static void log (int level, const char *fmt, va_list args)
> {
>   time_t now = time (NULL) ;
>   char timeString [30] ;
>   char *p = NULL ;
>   int out ;

>   strcpy (timeString,ctime (&now)) ;
>   timeString [24] = '\0' ;

>   fprintf (stderr, "%s %s: ",
>            timeString, (program ? program : "UNKNOWN PROGRAM NAME")) ;
>   out = vfprintf (stderr, fmt, args) ;
>   fprintf (stderr,"\n") ;

>   p = malloc (out + 10) ;
>   vsprintf (p,fmt,args) ;
>   syslog (level,p) ;       <----------------------------------
> }

Fixed in all branches.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>