Blob Blame History Raw
commit 0f605245cf3f37c2efe4e225237ad17256ea2a34
Author: Jeremy Sowden <jeremy.sowden@gmail.com>
Date:   Wed Jan 9 15:43:41 2013 +0000

    Fix buffer-overrun when logging key to delete in binary protocol.

diff --git a/memcached.c b/memcached.c
index 3a79fba..f7a140c 100644
--- a/memcached.c
+++ b/memcached.c
@@ -2190,7 +2190,12 @@ static void process_bin_delete(conn *c) {
     assert(c != NULL);
 
     if (settings.verbose > 1) {
-        fprintf(stderr, "Deleting %s\n", key);
+        int ii;
+        fprintf(stderr, "Deleting ");
+        for (ii = 0; ii < nkey; ++ii) {
+            fprintf(stderr, "%c", key[ii]);
+        }
+        fprintf(stderr, "\n");
     }
 
     if (settings.detail_enabled) {
commit fbe823d9a61b5149cd6e3b5e17bd28dd3b8dd760
Author: dormando <dormando@rydia.net>
Date:   Fri Dec 20 13:25:43 2013 -0800

    fix potential unbounded key prints
    
    item key isn't necessarily null terminated. user submitted a patch for one,
    this clears two more.

diff --git a/items.c b/items.c
index d70400c..65b1a24 100644
--- a/items.c
+++ b/items.c
@@ -537,12 +537,16 @@ item *do_item_get(const char *key, const size_t nkey, const uint32_t hv) {
     int was_found = 0;
 
     if (settings.verbose > 2) {
+        int ii;
         if (it == NULL) {
-            fprintf(stderr, "> NOT FOUND %s", key);
+            fprintf(stderr, "> NOT FOUND ");
         } else {
-            fprintf(stderr, "> FOUND KEY %s", ITEM_key(it));
+            fprintf(stderr, "> FOUND KEY ");
             was_found++;
         }
+        for (ii = 0; ii < nkey; ++ii) {
+            fprintf(stderr, "%c", key[ii]);
+        }
     }
 
     if (it != NULL) {
diff --git a/memcached.c b/memcached.c
index f7a140c..6486ff2 100644
--- a/memcached.c
+++ b/memcached.c
@@ -2856,8 +2856,14 @@ static inline void process_get_command(conn *c, token_t *tokens, size_t ntokens,
                 }
 
 
-                if (settings.verbose > 1)
-                    fprintf(stderr, ">%d sending key %s\n", c->sfd, ITEM_key(it));
+                if (settings.verbose > 1) {
+                    int ii;
+                    fprintf(stderr, ">%d sending key ", c->sfd);
+                    for (ii = 0; ii < it->nkey; ++ii) {
+                        fprintf(stderr, "%c", key[ii]);
+                    }
+                    fprintf(stderr, "\n");
+                }
 
                 /* item_get() has incremented it->refcount for us */
                 pthread_mutex_lock(&c->thread->stats.mutex);