>Number:         17483
>Category:       bin
>Synopsis:       /bin/systrace doesn't play nice with openlog(3)
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 04 12:43:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     
>Release:        NetBSD 1.6B
>Organization:
>Environment:
/usr/src/bin/systrace/intercept-translate.c:
     $NetBSD: intercept-translate.c,v 1.3 2002/06/18 21:21:17 thorpej Exp $
     $OpenBSD: intercept-translate.c,v 1.2 2002/06/04 19:15:54 deraadt Exp $

System: NetBSD stasis 1.6B NetBSD 1.6B (STASIS) #17: Tue Jul 2 16:46:41 BST 2002 xs@stasis:/usr/src/sys/arch/i386/compile/STASIS i386
Architecture: i386
Machine: i386
>Description:
	openlog(3) connects to /var/run/log with a PF_LOCAL socket. It does
	not fill in the SyslogAddr.sun_len. If sun_len is less than the
	sockaddr size, systrace will decrease the lenght it copies to sun_len.
	In this case, it is reduced to 0, and so nothing is copied. This
	leads to invalid syntax being generated.

>How-To-Repeat:
	systrace -A anything that uses openlog(3) With LOG_NDELAY it will
	fail sooner.
	eg:
#include <syslog.h>

int
main()
{
	openlog("test", LOG_NDELAY, LOG_AUTH);
	return 0;
}

>Fix:

Ignore sa_len. The kernel does. It overwrites sa_len with buflen in
uipc_syscalls.c:sockargs()

Index: intercept-translate.c
===================================================================
RCS file: /cvsroot/basesrc/bin/systrace/intercept-translate.c,v
retrieving revision 1.3
diff -u -r1.3 intercept-translate.c
--- intercept-translate.c	2002/06/18 21:21:17	1.3
+++ intercept-translate.c	2002/07/04 19:29:01
@@ -235,8 +235,6 @@
 
 	switch (sa->sa_family) {
 	case PF_LOCAL:
-		if (sa->sa_len < len)
-			len = sa->sa_len;
 		if (buflen < len + 1)
 			len = buflen - 1;
 		memcpy(buf, sa->sa_data, len);

>Release-Note:
>Audit-Trail:
>Unformatted: