2003-06-10 Chip Salzenberg <chip@pobox.com>

       * support/nfs/xlog.c (xlog): Fix off-by-one buffer overflow bug.
       * debian/changelog: Version 1.0.3-2.

diff --git a/ChangeLog b/ChangeLog
index 7b93669da6d5ca2c7a6fa089783c48bf2182264f..0c3295c08fca277fe98bd8bb14cd2b0a27269fc9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2003-06-10  Chip Salzenberg  <chip@pobox.com>
+
+       * support/nfs/xlog.c (xlog): Fix off-by-one buffer overflow bug.
+       * debian/changelog: Version 1.0.3-2.
+

 2003-05-30 Michael Griffith <grif@michaelgriffith.com>
        NeilBrown <neilb@cse.unsw.edu.au>
 
 2003-05-30 Michael Griffith <grif@michaelgriffith.com>
        NeilBrown <neilb@cse.unsw.edu.au>
 

diff --git a/debian/changelog b/debian/changelog
index ff84c2a1a902b095d86268723a9fa0e5a98e09a3..12e2886a02ef6f0f3e0e0aab3086225f8b4beb87 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+nfs-utils (1:1.0.3-2) unstable; urgency=high
+
+  * Upstream CVS sync:
+    > Fix one-byte buffer overflow in logging code.
+
+ -- Chip Salzenberg <chip@debian.org>  Tue, 10 Jun 2003 11:11:56 -0400
+

 nfs-utils (1:1.0.3-1) unstable; urgency=low
 
   * New upstream version:
 nfs-utils (1:1.0.3-1) unstable; urgency=low
 
   * New upstream version:

diff --git a/support/nfs/xlog.c b/support/nfs/xlog.c
index 90c7e635df9403ca6c89c75dba1ac59fa78fc182..c4e7ea1d4d6a4cbb51e544d999c86c998ef972fa 100644 (file)
--- a/support/nfs/xlog.c
+++ b/support/nfs/xlog.c
@@ -142,9 +142,9 @@ xlog(int kind, const char *fmt, ...)
                return;
 
        va_start(args, fmt);
                return;
 
        va_start(args, fmt);

-       vsnprintf(buff, sizeof (buff), fmt, args);
+       vsnprintf(buff, sizeof (buff) - 2, fmt, args);

        va_end(args);
        va_end(args);

-       buff[sizeof (buff) - 1] = 0;
+       buff[sizeof (buff) - 2] = 0;

 
        if ((n = strlen(buff)) > 0 && buff[n-1] != '\n') {
                buff[n++] = '\n'; buff[n++] = '\0';
 
        if ((n = strlen(buff)) > 0 && buff[n-1] != '\n') {
                buff[n++] = '\n'; buff[n++] = '\0';