commit 0f605245cf3f37c2efe4e225237ad17256ea2a34 Author: Jeremy Sowden Date: Wed Jan 9 15:43:41 2013 +0000 Fix buffer-overrun when logging key to delete in binary protocol. diff --git a/memcached.c b/memcached.c index 3a79fba..f7a140c 100644 --- a/memcached.c +++ b/memcached.c @@ -2190,7 +2190,12 @@ static void process_bin_delete(conn *c) { assert(c != NULL); if (settings.verbose > 1) { - fprintf(stderr, "Deleting %s\n", key); + int ii; + fprintf(stderr, "Deleting "); + for (ii = 0; ii < nkey; ++ii) { + fprintf(stderr, "%c", key[ii]); + } + fprintf(stderr, "\n"); } if (settings.detail_enabled) { commit fbe823d9a61b5149cd6e3b5e17bd28dd3b8dd760 Author: dormando Date: Fri Dec 20 13:25:43 2013 -0800 fix potential unbounded key prints item key isn't necessarily null terminated. user submitted a patch for one, this clears two more. diff --git a/items.c b/items.c index d70400c..65b1a24 100644 --- a/items.c +++ b/items.c @@ -537,12 +537,16 @@ item *do_item_get(const char *key, const size_t nkey, const uint32_t hv) { int was_found = 0; if (settings.verbose > 2) { + int ii; if (it == NULL) { - fprintf(stderr, "> NOT FOUND %s", key); + fprintf(stderr, "> NOT FOUND "); } else { - fprintf(stderr, "> FOUND KEY %s", ITEM_key(it)); + fprintf(stderr, "> FOUND KEY "); was_found++; } + for (ii = 0; ii < nkey; ++ii) { + fprintf(stderr, "%c", key[ii]); + } } if (it != NULL) { diff --git a/memcached.c b/memcached.c index f7a140c..6486ff2 100644 --- a/memcached.c +++ b/memcached.c @@ -2856,8 +2856,14 @@ static inline void process_get_command(conn *c, token_t *tokens, size_t ntokens, } - if (settings.verbose > 1) - fprintf(stderr, ">%d sending key %s\n", c->sfd, ITEM_key(it)); + if (settings.verbose > 1) { + int ii; + fprintf(stderr, ">%d sending key ", c->sfd); + for (ii = 0; ii < it->nkey; ++ii) { + fprintf(stderr, "%c", key[ii]); + } + fprintf(stderr, "\n"); + } /* item_get() has incremented it->refcount for us */ pthread_mutex_lock(&c->thread->stats.mutex);