7 files changed, 338 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index 0ab9043a1..0c7bfaca0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,8 @@
  - (djm) Fix Bug #442 for PAM case
  - (djm) Bug #110: bogus error messages in lastlog_get_entry(). Fix based
    on one by peak@argo.troja.mff.cuni.cz
+ - (djm) Bug #111: Run syslog and stderr logging through strnvis to eliminate
+   nasties. Report from peak@argo.troja.mff.cuni.cz
 
 20030103
  - (djm) Bug #461: ssh-copy-id fails with no arguments. Patch from 
@@ -936,4 +938,4 @@
      save auth method before monitor_reset_key_state(); bugzilla bug #284;
      ok provos@
 
-$Id: ChangeLog,v 1.2545 2003/01/07 05:46:58 djm Exp $
+$Id: ChangeLog,v 1.2546 2003/01/07 06:04:18 djm Exp $
diff --git a/configure.ac b/configure.ac
index f01c0c642..d4213af5f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.94 2003/01/07 04:18:33 djm Exp $
+# $Id: configure.ac,v 1.95 2003/01/07 06:04:18 djm Exp $
 
 AC_INIT
 AC_CONFIG_SRCDIR([ssh.c])
@@ -601,8 +601,8 @@ AC_CHECK_FUNCS(arc4random b64_ntop bcopy bindresvport_sa \
         realpath recvmsg rresvport_af sendmsg setdtablesize setegid \
         setenv seteuid setgroups setlogin setproctitle setresgid setreuid \
         setrlimit setsid setpcred setvbuf sigaction sigvec snprintf \
-        socketpair strerror strlcat strlcpy strmode sysconf tcgetpgrp \
-        truncate utimes vhangup vsnprintf waitpid __b64_ntop _getpty)
+        socketpair strerror strlcat strlcpy strmode strvis sysconf \
+        tcgetpgrp truncate utimes vhangup vsnprintf waitpid __b64_ntop \                _getpty)
 
 dnl Make sure strsep prototype is defined before defining HAVE_STRSEP
 AC_CHECK_DECL(strsep, [AC_CHECK_FUNCS(strsep)])
diff --git a/log.c b/log.c
index 96626d7d4..ead7e9028 100644
--- a/log.c
+++ b/log.c
@@ -386,11 +386,14 @@ do_log(LogLevel level, const char *fmt, va_list args)
         } else {
                 vsnprintf(msgbuf, sizeof(msgbuf), fmt, args);
         }
+        /* Escape magic chars in output. */
+        strnvis(fmtbuf, msgbuf, sizeof(fmtbuf), VIS_OCTAL);
+        
         if (log_on_stderr) {
-                fprintf(stderr, "%s\r\n", msgbuf);
+                fprintf(stderr, "%s\r\n", fmtbuf);
         } else {
                 openlog(argv0 ? argv0 : __progname, LOG_PID, log_facility);
-                syslog(pri, "%.500s", msgbuf);
+                syslog(pri, "%.500s", fmtbuf);
                 closelog();
         }
 }
diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
index 5229e7e20..8b1e5b538 100644
--- a/openbsd-compat/Makefile.in
+++ b/openbsd-compat/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.23 2002/09/12 00:33:02 djm Exp $
+# $Id: Makefile.in,v 1.24 2003/01/07 06:04:18 djm Exp $
 
 sysconfdir=@sysconfdir@
 piddir=@piddir@
@@ -16,7 +16,7 @@ RANLIB=@RANLIB@
 INSTALL=@INSTALL@
 LDFLAGS=-L. @LDFLAGS@
 
-OPENBSD=base64.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o
+OPENBSD=base64.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o vis.o
 
 COMPAT=bsd-arc4random.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-snprintf.o bsd-waitpid.o fake-getaddrinfo.o fake-getnameinfo.o xmmap.o
 
diff --git a/openbsd-compat/openbsd-compat.h b/openbsd-compat/openbsd-compat.h
index ae18afd34..dcb7ba15b 100644
--- a/openbsd-compat/openbsd-compat.h
+++ b/openbsd-compat/openbsd-compat.h
@@ -1,4 +1,4 @@
-/* $Id: openbsd-compat.h,v 1.17 2002/09/12 00:33:02 djm Exp $ */
+/* $Id: openbsd-compat.h,v 1.18 2003/01/07 06:04:18 djm Exp $ */
 
 #ifndef _OPENBSD_H
 #define _OPENBSD_H
@@ -26,6 +26,7 @@
 #include "glob.h"
 #include "readpassphrase.h"
 #include "getopt.h"
+#include "vis.h"
 
 /* Home grown routines */
 #include "bsd-arc4random.h"
diff --git a/openbsd-compat/vis.c b/openbsd-compat/vis.c
new file mode 100644
index 000000000..303a9a5b3
--- /dev/null
+++ b/openbsd-compat/vis.c
@@ -0,0 +1,232 @@
+/*-
+ * Copyright (c) 1989, 1993
+ *      The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the University of
+ *      California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include "config.h"
+#if !defined(HAVE_STRVIS)
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static char rcsid[] = "$OpenBSD: vis.c,v 1.8 2002/02/19 19:39:36 millert Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include <ctype.h>
+
+#include "vis.h"
+
+#define isoctal(c)      (((u_char)(c)) >= '0' && ((u_char)(c)) <= '7')
+#define isvisible(c)    (((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) && \
+                                isgraph((u_char)(c))) ||                     \
+                                ((flag & VIS_SP) == 0 && (c) == ' ') ||      \
+                                ((flag & VIS_TAB) == 0 && (c) == '\t') ||    \
+                                ((flag & VIS_NL) == 0 && (c) == '\n') ||     \
+                                ((flag & VIS_SAFE) &&                        \
+                                ((c) == '\b' || (c) == '\007' || (c) == '\r')))
+
+/*
+ * vis - visually encode characters
+ */
+char *
+vis(dst, c, flag, nextc)
+        register char *dst;
+        int c, nextc;
+        register int flag;
+{
+        if (isvisible(c)) {
+                *dst++ = c;
+                if (c == '\\' && (flag & VIS_NOSLASH) == 0)
+                        *dst++ = '\\';
+                *dst = '\0';
+                return (dst);
+        }
+
+        if (flag & VIS_CSTYLE) {
+                switch(c) {
+                case '\n':
+                        *dst++ = '\\';
+                        *dst++ = 'n';
+                        goto done;
+                case '\r':
+                        *dst++ = '\\';
+                        *dst++ = 'r';
+                        goto done;
+                case '\b':
+                        *dst++ = '\\';
+                        *dst++ = 'b';
+                        goto done;
+                case '\a':
+                        *dst++ = '\\';
+                        *dst++ = 'a';
+                        goto done;
+                case '\v':
+                        *dst++ = '\\';
+                        *dst++ = 'v';
+                        goto done;
+                case '\t':
+                        *dst++ = '\\';
+                        *dst++ = 't';
+                        goto done;
+                case '\f':
+                        *dst++ = '\\';
+                        *dst++ = 'f';
+                        goto done;
+                case ' ':
+                        *dst++ = '\\';
+                        *dst++ = 's';
+                        goto done;
+                case '\0':
+                        *dst++ = '\\';
+                        *dst++ = '0';
+                        if (isoctal(nextc)) {
+                                *dst++ = '0';
+                                *dst++ = '0';
+                        }
+                        goto done;
+                }
+        }
+        if (((c & 0177) == ' ') || (flag & VIS_OCTAL)) {        
+                *dst++ = '\\';
+                *dst++ = ((u_char)c >> 6 & 07) + '0';
+                *dst++ = ((u_char)c >> 3 & 07) + '0';
+                *dst++ = ((u_char)c & 07) + '0';
+                goto done;
+        }
+        if ((flag & VIS_NOSLASH) == 0)
+                *dst++ = '\\';
+        if (c & 0200) {
+                c &= 0177;
+                *dst++ = 'M';
+        }
+        if (iscntrl(c)) {
+                *dst++ = '^';
+                if (c == 0177)
+                        *dst++ = '?';
+                else
+                        *dst++ = c + '@';
+        } else {
+                *dst++ = '-';
+                *dst++ = c;
+        }
+done:
+        *dst = '\0';
+        return (dst);
+}
+
+/*
+ * strvis, strnvis, strvisx - visually encode characters from src into dst
+ *      
+ *      Dst must be 4 times the size of src to account for possible
+ *      expansion.  The length of dst, not including the trailing NULL,
+ *      is returned. 
+ *
+ *      Strnvis will write no more than siz-1 bytes (and will NULL terminate).
+ *      The number of bytes needed to fully encode the string is returned.
+ *
+ *      Strvisx encodes exactly len bytes from src into dst.
+ *      This is useful for encoding a block of data.
+ */
+int
+strvis(dst, src, flag)
+        register char *dst;
+        register const char *src;
+        int flag;
+{
+        register char c;
+        char *start;
+
+        for (start = dst; (c = *src);)
+                dst = vis(dst, c, flag, *++src);
+        *dst = '\0';
+        return (dst - start);
+}
+
+int
+strnvis(dst, src, siz, flag)
+        register char *dst;
+        register const char *src;
+        size_t siz;
+        int flag;
+{
+        register char c;
+        char *start, *end;
+
+        for (start = dst, end = start + siz - 1; (c = *src) && dst < end; ) {
+                if (isvisible(c)) {
+                        *dst++ = c;
+                        if (c == '\\' && (flag & VIS_NOSLASH) == 0) {
+                                /* need space for the extra '\\' */
+                                if (dst < end)
+                                        *dst++ = '\\';
+                                else {
+                                        dst--;
+                                        break;
+                                }
+                        }
+                        src++;
+                } else {
+                        /* vis(3) requires up to 4 chars */
+                        if (dst + 3 < end)
+                                dst = vis(dst, c, flag, *++src);
+                        else
+                                break;
+                }
+        }
+        *dst = '\0';
+        if (dst >= end) {
+                char tbuf[5];
+
+                /* adjust return value for truncation */
+                while ((c = *src))
+                        dst += vis(tbuf, c, flag, *++src) - tbuf;
+        }
+        return (dst - start);
+}
+
+int
+strvisx(dst, src, len, flag)
+        register char *dst;
+        register const char *src;
+        register size_t len;
+        int flag;
+{
+        register char c;
+        char *start;
+
+        for (start = dst; len > 1; len--) {
+                c = *src;
+                dst = vis(dst, c, flag, *++src);
+        }
+        if (len)
+                dst = vis(dst, *src, flag, '\0');
+        *dst = '\0';
+        return (dst - start);
+}
+
+#endif
diff --git a/openbsd-compat/vis.h b/openbsd-compat/vis.h
new file mode 100644
index 000000000..98924bde4
--- /dev/null
+++ b/openbsd-compat/vis.h
@@ -0,0 +1,91 @@
+/*      $OpenBSD: vis.h,v 1.5 2002/02/16 21:27:17 millert Exp $ */
+/*      $NetBSD: vis.h,v 1.4 1994/10/26 00:56:41 cgd Exp $      */
+
+/*-
+ * Copyright (c) 1990 The Regents of the University of California.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the University of
+ *      California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *      @(#)vis.h       5.9 (Berkeley) 4/3/91
+ */
+#include "config.h"
+#if !defined(HAVE_STRVIS)
+
+#ifndef _VIS_H_
+#define _VIS_H_
+
+#include <sys/types.h>
+#include <limits.h>
+
+/*
+ * to select alternate encoding format
+ */
+#define VIS_OCTAL       0x01    /* use octal \ddd format */
+#define VIS_CSTYLE      0x02    /* use \[nrft0..] where appropriate */
+
+/*
+ * to alter set of characters encoded (default is to encode all
+ * non-graphic except space, tab, and newline).
+ */
+#define VIS_SP          0x04    /* also encode space */
+#define VIS_TAB         0x08    /* also encode tab */
+#define VIS_NL          0x10    /* also encode newline */
+#define VIS_WHITE       (VIS_SP | VIS_TAB | VIS_NL)
+#define VIS_SAFE        0x20    /* only encode "unsafe" characters */
+
+/*
+ * other
+ */
+#define VIS_NOSLASH     0x40    /* inhibit printing '\' */
+
+/*
+ * unvis return codes
+ */
+#define UNVIS_VALID      1      /* character valid */
+#define UNVIS_VALIDPUSH  2      /* character valid, push back passed char */
+#define UNVIS_NOCHAR     3      /* valid sequence, no character produced */
+#define UNVIS_SYNBAD    -1      /* unrecognized escape sequence */
+#define UNVIS_ERROR     -2      /* decoder in unknown state (unrecoverable) */
+
+/*
+ * unvis flags
+ */
+#define UNVIS_END       1       /* no more characters */
+
+char    *vis(char *, int, int, int);
+int     strvis(char *, const char *, int);
+int     strnvis(char *, const char *, size_t, int);
+int     strvisx(char *, const char *, size_t, int);
+int     strunvis(char *, const char *);
+int     unvis(char *, char, int *, int);
+
+#endif /* !_VIS_H_ */
+
+#endif /* !HAVE_STRVIS */