Fix syslog buffer overflow (Bug#270, reported by Kevin Jordan)

diff --git a/commands/syslogd/syslog.c b/commands/syslogd/syslog.c
index caf2120e4d79a0727c399da6fc9149096ff8abb6..8db82df3c4078250023ec7769192645a605b418e 100644 (file)
--- a/commands/syslogd/syslog.c
+++ b/commands/syslogd/syslog.c
@@ -139,7 +139,7 @@ void syslog(int lprty, const char *msg,...)
        len += sprintf(buff + len, "[%d]: ", LogPid);
   }
   va_start(ap, msg);
-  len += vsprintf(buff + len, msg, ap);
+  len += vsnprintf(buff + len, sizeof(buff) - len, msg, ap);
   va_end(ap);
   rc = write(nfd, buff, len);
   if ((rc != len && LogFlags & LOG_CONS) || LogFlags & LOG_PERROR) {