Re: Bug #3027: error_log interpets % as printf formats and chrashes
| From: | Adam Trachtenberg | Date: | Wed, 22 Dec 1999 21:32:10 +0000 |
| Subject: | Re: Bug #3027: error_log interpets % as printf formats and chrashes | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-13948@lists.php.net to get a copy of this message | ||
On 22 Dec 1999 zot@zotconsulting.com wrote:
> From: zot@zotconsulting.com
> Operating system: Linux, FreeBSD
> PHP version: 3.0.12
> PHP Bug Type: Reproduceable crash
> Bug description: error_log interpets % as printf formats and chrashes
>
> error_log("'%eagle'");
>
> produces in the apache error_log:
> [Wed Dec 22 11:28:26 1999] [error] '5.318473e-315agle'
>
> other printf strings. In a sql statement of length it crashes
> repeatedly on any query that has a %e %f %g %h %n
>
> My guess is error_log is taking from the next set of arguments, the
> values for %. Thus it is causing a buffer overflow from time to time.
> though error_log("'%etttt'"); shows the same scientific number as
> eagle.
I've come across this problem before -- I thought I saw Ken Coar patch
this, however.
I just did some checking: see
http://bugs.php.net/bugs.php3?id=1955&edit=1
and this really long url
http://bonsai.php.net/bonsai/cvsview2.cgi?diff_mode=context&whitespace_mode=show&subdir=php3&command=DIFF_FRAMESET&file=main.c&rev1=1.504&rev2=1.505&root=/local/repository
-adam
--
/ adam maccabee trachtenberg | visit college life online \
\ adam@student.net | http://www.student.com /