logger: Segmentation fault when reading from stdin and writing to socket

[Patrick Plagwitz <patrick.plagwitz@fau.de>]

[-- Attachment #1: Type: text/plain, Size: 742 bytes --]

Hi,

I have noticed a bug within the development version of the logger
utility (misc-utils/logger.c).
When reading messages from stdin (so that logger_stdin is called) and
outputting to a TCP/UDP socket (inet_socket) logger SEGFAULTs:

$ echo foo | logger -n localhost
Segmentation fault (core dumped)

This bug happens because, in this combination, the syslog header isn't
generated before calling strlen() on it and has probably been introduced
somewhere when separating writing the header and writing the message.
Calling generate_syslog_header in logger_open also for inet sockets
fixes this.
The attached patch does just that.

On an unrelated note, the write_output function leaks memory by not
freeing the buf local variable.

Patrick

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: patch.diff --]
[-- Type: text/x-patch; name="patch.diff", Size: 855 bytes --]

diff --git a/misc-utils/logger.c b/misc-utils/logger.c
index edc9483..fbe8ced 100644
--- a/misc-utils/logger.c
+++ b/misc-utils/logger.c
@@ -582,14 +582,15 @@ static void logger_open(struct logger_ctl *ctl)
 		ctl->fd = inet_socket(ctl->server, ctl->port, ctl->socket_type);
 		if (!ctl->syslogfp)
 			ctl->syslogfp = syslog_rfc5424_header;
-		return;
+	} else {
+		if (!ctl->unix_socket)
+			ctl->unix_socket = _PATH_DEVLOG;
+
+		ctl->fd = unix_socket(ctl, ctl->unix_socket, ctl->socket_type);
+		if (!ctl->syslogfp)
+			ctl->syslogfp = syslog_local_header;
 	}
-	if (!ctl->unix_socket)
-		ctl->unix_socket = _PATH_DEVLOG;
 
-	ctl->fd = unix_socket(ctl, ctl->unix_socket, ctl->socket_type);
-	if (!ctl->syslogfp)
-		ctl->syslogfp = syslog_local_header;
 	if (!ctl->tag)
 		ctl->tag = xgetlogin();
 	generate_syslog_header(ctl);