From: Frédéric Marchal Date: Thu, 4 Feb 2010 10:25:17 +0000 (+0000) Subject: Read longer lines from access.log and abort if line is too long X-Git-Tag: v2_2_7~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ab95063706a6156c842996e0bd23a931486b5baf;p=thirdparty%2Fsarg.git Read longer lines from access.log and abort if line is too long --- diff --git a/CMakeLists.txt b/CMakeLists.txt index a802e0b..e005ab5 100755 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -3,7 +3,7 @@ PROJECT(sarg C) SET(sarg_VERSION 2) SET(sarg_REVISION 2) SET(sarg_BUILD "7") -SET(sarg_BUILDDATE "Feb-02-2010") +SET(sarg_BUILDDATE "Feb-04-2010") INCLUDE(AddFileDependencies) INCLUDE(CheckIncludeFile) diff --git a/ChangeLog b/ChangeLog index 08453da..2301f50 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,6 @@ SARG ChangeLog -Jan-29-2010 Version 2.2.7 +Feb-04-2010 Version 2.2.7 - Extra compile and run time protection (FORTIFY_SOURCE) fixed in configure. - Use tabulations as columns separator in intermediary files to avoid problems when a field of the log contains a space. - Input log file type detection partly rewritten to clearly distinguish which type is processed where. @@ -25,6 +25,7 @@ Jan-29-2010 Version 2.2.7 - Does not report URLs consisting of only a host name ending with .com as a downloaded file. - Mangle the $ and @ signs in user ID to make the resulting file name valid in shell commands. - Fixed a regression in the default value of --enable-sargphp. + - Increase the maximum size of a line read from access.log and detect longer lines that were silently splitted in previous versions. Jan-06-2010 Version 2.2.6.1 - Remove unnecessary dependency on off_t. diff --git a/include/info.h b/include/info.h index 728f0f0..e0693c9 100755 --- a/include/info.h +++ b/include/info.h @@ -1,3 +1,3 @@ -#define VERSION PACKAGE_VERSION" Feb-02-2010" +#define VERSION PACKAGE_VERSION" Feb-04-2010" #define PGM PACKAGE_NAME #define URL "http://sarg.sourceforge.net" diff --git a/log.c b/log.c index ffb4d96..366909b 100644 --- a/log.c +++ b/log.c @@ -98,8 +98,7 @@ int main(int argc,char *argv[]) char tbuf2[128]; char zip[20]; char *str; - char bufz[MAXLEN]; - char bufy[MAXLEN]; + char bufz[2*MAXLEN]; char tmp2[MAXLEN]; char start_hour[128]; char end_hour[128]; @@ -118,6 +117,7 @@ int main(int argc,char *argv[]) int exstring=0; int isa_ncols=0,isa_cols[ISACOL_Last]; int from_stdin; + int blen; long totregsl=0; long totregsg=0; long totregsx=0; @@ -731,6 +731,11 @@ int main(int argc,char *argv[]) } while(fgets(bufz,sizeof(bufz),fp_in)!=NULL) { + blen=strlen(bufz); + if (blen>0 && bufz[blen-1]!='\r' && bufz[blen-1]!='\n' && !feof(fp_in)) { + fprintf(stderr,"SARG: line too long (more than %d bytes) in %s\n",sizeof(bufz)-1,arq); + exit(1); + } if (ilf==ILF_Unknown) { if(strncmp(bufz,"#Software: Mic",14) == 0) { @@ -776,12 +781,10 @@ int main(int argc,char *argv[]) fflush (stdout); OutputNonZero = REPORT_EVERY_X_LINES ; } - if(strlen(bufz) > MAXLEN-1) continue; - if(!bufz[0]) continue; + if(blen < 58) continue; if(strstr(bufz,"HTTP/0.0") != 0) continue; if(strstr(bufz,"logfile turned over") != 0) continue; if(bufz[0] == ' ') continue; - if(strlen(bufz) < 58) continue; // Record only hours usage which is required tt = (time_t) strtoul( bufz, NULL, 10 ); @@ -798,22 +801,20 @@ int main(int argc,char *argv[]) // exclude_string exstring=0; if(ExcludeString[0] != '\0') { - strcpy(warea,bufz); getword_start(&gwarea,ExcludeString); while(strchr(gwarea.current,':') != 0) { if (getword_multisep(val1,sizeof(val1),&gwarea,':')<0) { printf("SARG: Maybe you have a broken record or garbage in your exclusion string.\n"); exit(1); } - if((str=(char *) strstr(warea,val1)) != (char *) NULL ) + if((str=(char *) strstr(bufz,val1)) != (char *) NULL ) exstring++; } - if((str=(char *) strstr(warea,gwarea.current)) != (char *) NULL ) + if((str=(char *) strstr(bufz,gwarea.current)) != (char *) NULL ) exstring++; } if(exstring) continue; - strcpy(bufy,bufz); if ((str = strchr(bufz, '\n')) != NULL) *str = '\0'; /* strip \n */ @@ -824,7 +825,7 @@ int main(int argc,char *argv[]) if (ilf==ILF_Squid || ilf==ILF_Common || ilf==ILF_Unknown) { getword_start(&gwarea,bufz); if (getword(data,sizeof(data),&gwarea,' ')<0) { - printf("SARG: Maybe you have a broken record or garbage in your access.log file.\n"); + printf("SARG: Maybe you have a broken time in your access.log file.\n"); exit(1); } if((str=(char *) strchr(data, '.')) != (char *) NULL ) { @@ -874,33 +875,33 @@ int main(int argc,char *argv[]) if(ilf==ILF_Unknown || ilf==ILF_Squid) { if (getword(elap,sizeof(elap),&gwarea,' ')<0) { - printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",arq); + printf("SARG: Maybe you have a broken elapsed time in your %s file.\n",arq); exit(1); } while(strcmp(elap,"") == 0 && gwarea.current[0] != '\0') if (getword(elap,sizeof(elap),&gwarea,' ')<0) { - printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",arq); + printf("SARG: Maybe you have a broken elapsed time in your %s file.\n",arq); exit(1); } if(strlen(elap) < 1) continue; if (getword(ip,sizeof(ip),&gwarea,' ')<0){ - printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",arq); + printf("SARG: Maybe you have a broken client IP address in your %s file.\n",arq); exit(1); } if (getword(code,sizeof(code),&gwarea,' ')<0){ - printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",arq); + printf("SARG: Maybe you have a broken result code in your %s file.\n",arq); exit(1); } if (getword(tam,sizeof(tam),&gwarea,' ')<0){ - printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",arq); + printf("SARG: Maybe you have a broken amount of data in your %s file.\n",arq); exit(1); } if (getword(fun,sizeof(fun),&gwarea,' ')<0){ - printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",arq); + printf("SARG: Maybe you have a broken request method in your %s file.\n",arq); exit(1); } if (getword(url,sizeof(url),&gwarea,' ')<0){ - printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",arq); + printf("SARG: Maybe you have a broken URI in your %s file.\n",arq); exit(1); } // while (strstr(bufz,"%20") != 0) { @@ -908,7 +909,7 @@ int main(int argc,char *argv[]) // strcat(url,warea); // } if (getword(user,sizeof(user),&gwarea,' ')<0){ - printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",arq); + printf("SARG: Maybe you have a broken user ID in your %s file.\n",arq); exit(1); } ilf=ILF_Squid;