[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

[PATCH] Auditd string termination bug fix



Hi,

Attached is simple fix for auditd that it assumed incoming msg
is c string(null terminated) but they are not sometimes.
I briefly looked into kernel audit code, it looks like it is sending out
exact length of string, no '\0' at the end of message string so
auditd's log sometimes corrupted.
It's a small patch from my plugin support auditd.

-- Junji Kaneamru

Linuon Inc.
Tokyo Japan
--- audit-0.6.1/lib/libaudit.c	2005-01-09 05:39:41.000000000 +0900
+++ audit-0.6.1-plugin/lib/libaudit.c	2005-01-30 16:24:49.000000000 +0900
@@ -306,8 +306,8 @@
 	if (buf==NULL)
 		return NULL;
 
-	snprintf(buf, max_buf, "type=%s msg=%s", 
-		audit_msg_type_to_name(rep->type),
+	snprintf(buf, max_buf, "type=%s msg=%.*s", 
+		audit_msg_type_to_name(rep->type), rep->len,
 		rep->message);
 
 	/* Replace \n with space so it looks nicer. */

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]