summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--libsyslog/CHANGELOG.md4
-rw-r--r--libsyslog/src/syslog.rs16
2 files changed, 14 insertions, 6 deletions
diff --git a/libsyslog/CHANGELOG.md b/libsyslog/CHANGELOG.md
index 599180d..0a0e2e7 100644
--- a/libsyslog/CHANGELOG.md
+++ b/libsyslog/CHANGELOG.md
@@ -8,6 +8,10 @@ adheres to [Semantic Versioning][semver].
## Unreleased
+### Fixed
+
+ - Stop insecurely passing untrusted data syslog().
+
## 0.1.0 - 2023-02-24
Initial release.
diff --git a/libsyslog/src/syslog.rs b/libsyslog/src/syslog.rs
index 6b36147..2a4d856 100644
--- a/libsyslog/src/syslog.rs
+++ b/libsyslog/src/syslog.rs
@@ -76,13 +76,17 @@ impl log::Log for Syslog {
fn log(&self, record: &Record) {
if self.enabled(record.metadata()) {
- if let Ok(msg) = CString::new(format!("{}", record.args())) {
+ if let (Ok(fmt), Ok(msg)) = ( CString::new("%s"),
+ CString::new(format!("{}", record.args())))
+ {
+ let fmt_ptr = fmt.as_ptr();
+ let msg_ptr = msg.as_ptr();
match record.level() {
- Level::Debug => unsafe { syslog(LOG_DEBUG, msg.as_ptr()); }
- Level::Error => unsafe { syslog(LOG_ERR, msg.as_ptr()); }
- Level::Info => unsafe { syslog(LOG_INFO, msg.as_ptr()); }
- Level::Warn => unsafe { syslog(LOG_WARNING, msg.as_ptr()); }
- Level::Trace => unsafe { syslog(LOG_DEBUG, msg.as_ptr()); }
+ Level::Debug => unsafe { syslog(LOG_DEBUG, fmt_ptr, msg_ptr); }
+ Level::Error => unsafe { syslog(LOG_ERR, fmt_ptr, msg_ptr); }
+ Level::Info => unsafe { syslog(LOG_INFO, fmt_ptr, msg_ptr); }
+ Level::Warn => unsafe { syslog(LOG_WARNING, fmt_ptr, msg_ptr); }
+ Level::Trace => unsafe { syslog(LOG_DEBUG, fmt_ptr, msg_ptr); }
}
}
}