* rotatelogs: Fix possible buffer overflow if admin configures a

     mongo log file path.
     Trunk already has a fix.
     2.2.x patch: http://people.apache.org/~trawick/rotatelogs.overflow.txt
     +1: trawick, rpluem, lars, jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@987780 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 2586c267231c0bcbd95e4ea12b3ef87d49920e9b..fc7c31181a839e4183fef1836a1a1f1ee6966d9c 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.2.17
 
+  *) rotatelogs: Fix possible buffer overflow if admin configures a
+     mongo log file path. [Jeff Trawick]
+
   *) mod_ssl: Do not do overlapping memcpy. PR 45444 [Joe Orton]
 
   *) vhost: A purely-numeric Host: header should not be treated as a port.

diff --git a/STATUS b/STATUS
index d5d3b42a8924100930a5bf576c2ae1a18999eea0..24deff195de3052be4b9a645a312eb4d199032e5 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -87,11 +87,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-   * rotatelogs: Fix possible buffer overflow if admin configures a
-     mongo log file path.
-     Trunk already has a fix.
-     2.2.x patch: http://people.apache.org/~trawick/rotatelogs.overflow.txt
-     +1: trawick, rpluem, lars, jim
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]

diff --git a/support/rotatelogs.c b/support/rotatelogs.c
index 8fd99dc77deeead1ba29f09cccbb3bf589b90837..1e7218f1dddef9565098309a1c038d948b3fe865 100644 (file)
--- a/support/rotatelogs.c
+++ b/support/rotatelogs.c
@@ -248,7 +248,7 @@ int main (int argc, const char * const argv[])
                 apr_strftime(buf2, &rs, sizeof(buf2), szLogRoot, &e);
             }
             else {
-                sprintf(buf2, "%s.%010d", szLogRoot, tLogStart);
+                apr_snprintf(buf2, sizeof(buf2), "%s.%010d", szLogRoot, tLogStart);
             }
             tLogEnd = tLogStart + tRotation;
             pfile_prev = pfile;