Fix the computing of the date to filter out in the dansguardian log

The date to filter out when reading a dansguardian log is computed
through a string manipulation that fails when the day is encoded over
one digit.

This patch should fix the computation of the date value.

Thanks to Iain Lopata for reporting this bug.

diff --git a/dansguardian_log.c b/dansguardian_log.c
index b40b1367620858d822775450b14f0e885a10eb90..3b27f4b5ee4205a363bf2efe9e7264cb60628d31 100644 (file)
--- a/dansguardian_log.c
+++ b/dansguardian_log.c
@@ -34,11 +34,10 @@ void dansguardian_log(void)
        char guard_in[MAXLEN];
        char guard_ou[MAXLEN];
        char loglocation[MAXLEN] = "/var/log/dansguardian/access.log";
-       char year[10], mon[10], day[10];
+       int year, mon, day;
        char hour[15];
        char user[MAXLEN], code1[255], code2[255];
        char ip[45];
-       char wdata[127];
        char *url;
        char tmp6[MAXLEN];
        int  idata=0;
@@ -93,8 +92,8 @@ void dansguardian_log(void)
                if(strstr(buf," *DENIED* ") == 0)
                        continue;
                getword_start(&gwarea,buf);
-               if (getword(year,sizeof(year),&gwarea,'.')<0 || getword(mon,sizeof(mon),&gwarea,'.')<0 ||
-                   getword(day,sizeof(day),&gwarea,' ')<0 || getword(hour,sizeof(hour),&gwarea,' ')<0 ||
+               if (getword_atoi(&year,&gwarea,'.')<0 || getword_atoi(&mon,&gwarea,'.')<0 ||
+                   getword_atoi(&day,&gwarea,' ')<0 || getword(hour,sizeof(hour),&gwarea,' ')<0 ||
                    getword(user,sizeof(user),&gwarea,' ')<0 || getword(ip,sizeof(ip),&gwarea,' ')<0 ||
                    getword_skip(MAXLEN,&gwarea,'/')<0 || getword_skip(MAXLEN,&gwarea,'/')<0) {
                        debuga(_("Maybe you have a broken record or garbage in your %s file\n"),loglocation);
@@ -109,8 +108,7 @@ void dansguardian_log(void)
                        debuga(_("Maybe you have a broken record or garbage in your %s file\n"),loglocation);
                        exit(EXIT_FAILURE);
                }
-               sprintf(wdata,"%s%02d%s",year,atoi(mon),day);
-               idata = atoi(wdata);
+               idata = year*10000+mon*100+day;
 
                if(DansguardianFilterOutDate) {
                        if(idata < dfrom || idata > duntil)

diff --git a/include/defs.h b/include/defs.h
index dd0266630c922ff2da37378180d75569b8d95f86..3931f575cbbe25a0a60909f5882c7f2d441db6e2 100755 (executable)
--- a/include/defs.h
+++ b/include/defs.h
@@ -222,6 +222,7 @@ __attribute__((warn_unused_result)) int getword_limit(/*@out@*/char *word, int l
 __attribute__((warn_unused_result)) int getword_multisep(/*@out@*/char *word, int limit, struct getwordstruct *gwarea, char stop);
 __attribute__((warn_unused_result)) int getword_skip(int limit, struct getwordstruct *gwarea, char stop);
 __attribute__((warn_unused_result)) int getword_atoll(/*@out@*/long long int *number, struct getwordstruct *gwarea, char stop);
+__attribute__((warn_unused_result)) int getword_atoi(/*@out@*/int *number, struct getwordstruct *gwarea, char stop);
 __attribute__((warn_unused_result)) int getword_ptr(char *orig_line,/*@out@*/char **word, struct getwordstruct *gwarea, char stop);
 long long int my_atoll (const char *nptr);
 int is_absolute(const char *path);

diff --git a/util.c b/util.c
index b03acb60457a79cef66d625638692937c03a6664..b99fd6283bcf8657bf90ce148e18e1343ea7a343 100644 (file)
--- a/util.c
+++ b/util.c
@@ -207,6 +207,45 @@ int getword_atoll(long long int *number, struct getwordstruct *gwarea, char stop
        return(0);
 }
 
+int getword_atoi(int *number, struct getwordstruct *gwarea, char stop)
+{
+       int x;
+       int sign=+1;
+       int digit;
+
+       if (gwarea->current[0] == '-') {
+               gwarea->current++;
+               sign=-1;
+       } else if (gwarea->current[0] == '+') {
+               gwarea->current++;
+       }
+       *number=0;
+       for(x=0;isdigit(gwarea->current[x]);x++) {
+               digit=gwarea->current[x]-'0';
+               if (*number > (INT_MAX-digit)/10) {
+                       debuga(_("Integer overflow detected in getword_atoi in line %s\n"),gwarea->beginning);
+                       return(-1);
+               }
+               *number=(*number * 10) + digit;
+       }
+       if(gwarea->current[x] && gwarea->current[x]!=stop) {
+               printf("SARG: getword_atoi loop detected after %d bytes.\n",x);
+               printf("SARG: Line=\"%s\"\n",gwarea->beginning);
+               printf("SARG: Record=\"%s\"\n",gwarea->current);
+               printf("SARG: searching for \'x%x\'\n",stop);
+               //printf("SARG: Maybe you have a broken record or garbage in your access.log file.\n");
+#if USE_GETWORD_BACKTRACE
+               getword_backtrace();
+#endif
+               return(-1);
+       }
+       *number*=sign;
+
+       if (gwarea->current[x]) ++x;
+       gwarea->current+=x;
+       return(0);
+}
+
 
 int getword_ptr(char *orig_line,char **word, struct getwordstruct *gwarea, char stop)
 {