Fix a non-exploitable buffer overflow in the word splitting code. This

should really be rewritten.

diff --git a/logging.c b/logging.c
index c7bd566e4c4075e5b12294c09ec4cb9f37f13dad..767219671766b51bd638585a455aa34190cdcdbf 100644 (file)
--- a/logging.c
+++ b/logging.c
@@ -139,7 +139,8 @@ do_syslog(pri, msg)
     /*
      * Log the full line, breaking into multiple syslog(3) calls if necessary
      */
-    for (p = msg, count = 0; count < strlen(msg) / MAXSYSLOGLEN + 1; count++) {
+    for (p = msg, count = 0; *p && count < strlen(msg) / MAXSYSLOGLEN + 1;
+       count++) {
        if (strlen(p) > MAXSYSLOGLEN) {
            /*
             * Break up the line into what will fit on one syslog(3) line
@@ -162,7 +163,7 @@ do_syslog(pri, msg)
            *tmp = save;                        /* restore saved character */
 
            /* Eliminate leading whitespace */
-           for (p = tmp; *p != ' '; p++)
+           for (p = tmp; *p != ' ' && *p !='\0'; p++)
                ;
        } else {
            if (count == 0)