Handle %%m properly in syslog format string. Previously it would expand

the %m into the errno and then vfprintf would expand the % and the first
character of the strerror(3) return causing possible data corruption.

1 files changed, 13 insertions, 3 deletions

diff --git a/lib/libc/gen/syslog.c b/lib/libc/gen/syslog.c
index 261dd10..8c5a2e3 100644
--- a/lib/libc/gen/syslog.c
+++ b/lib/libc/gen/syslog.c
@@ -189,13 +189,23 @@ vsyslog(pri, fmt, ap)
 			return;
 		}
 
-		/* Substitute error message for %m. */
-		for ( ; (ch = *fmt); ++fmt)
+		/*
+		 * Substitute error message for %m.  Be careful not to
+		 * molest an escaped percent "%%m".  We want to pass it
+		 * on untouched as the format is later parsed by vfprintf.
+		 */
+		for ( ; (ch = *fmt); ++fmt) {
 			if (ch == '%' && fmt[1] == 'm') {
 				++fmt;
 				fputs(strerror(saved_errno), fmt_fp);
-			} else
+			} else if (ch == '%' && fmt[1] == '%') {
+				++fmt;
+				fputc(ch, fmt_fp);
 				fputc(ch, fmt_fp);
+			} else {
+				fputc(ch, fmt_fp);
+			}
+		}
 
 		/* Null terminate if room */
 		fputc(0, fmt_fp);