diff options
| -rw-r--r-- | libsyslog/CHANGELOG.md | 4 | ||||
| -rw-r--r-- | libsyslog/src/syslog.rs | 16 |
2 files changed, 14 insertions, 6 deletions
diff --git a/libsyslog/CHANGELOG.md b/libsyslog/CHANGELOG.md index 599180d..0a0e2e7 100644 --- a/libsyslog/CHANGELOG.md +++ b/libsyslog/CHANGELOG.md @@ -8,6 +8,10 @@ adheres to [Semantic Versioning][semver]. ## Unreleased +### Fixed + + - Stop insecurely passing untrusted data syslog(). + ## 0.1.0 - 2023-02-24 Initial release. diff --git a/libsyslog/src/syslog.rs b/libsyslog/src/syslog.rs index 6b36147..2a4d856 100644 --- a/libsyslog/src/syslog.rs +++ b/libsyslog/src/syslog.rs @@ -76,13 +76,17 @@ impl log::Log for Syslog { fn log(&self, record: &Record) { if self.enabled(record.metadata()) { - if let Ok(msg) = CString::new(format!("{}", record.args())) { + if let (Ok(fmt), Ok(msg)) = ( CString::new("%s"), + CString::new(format!("{}", record.args()))) + { + let fmt_ptr = fmt.as_ptr(); + let msg_ptr = msg.as_ptr(); match record.level() { - Level::Debug => unsafe { syslog(LOG_DEBUG, msg.as_ptr()); } - Level::Error => unsafe { syslog(LOG_ERR, msg.as_ptr()); } - Level::Info => unsafe { syslog(LOG_INFO, msg.as_ptr()); } - Level::Warn => unsafe { syslog(LOG_WARNING, msg.as_ptr()); } - Level::Trace => unsafe { syslog(LOG_DEBUG, msg.as_ptr()); } + Level::Debug => unsafe { syslog(LOG_DEBUG, fmt_ptr, msg_ptr); } + Level::Error => unsafe { syslog(LOG_ERR, fmt_ptr, msg_ptr); } + Level::Info => unsafe { syslog(LOG_INFO, fmt_ptr, msg_ptr); } + Level::Warn => unsafe { syslog(LOG_WARNING, fmt_ptr, msg_ptr); } + Level::Trace => unsafe { syslog(LOG_DEBUG, fmt_ptr, msg_ptr); } } } } |