Format string bug in parselog.pl

[Emanuel Bronshtein]

Binary package hint: samba-doc

samba-doc/examples/scripts/eventlog/parselog.pl have format string bug .

test case :
emanuel@amd64 /tmp>>echo '1 1 1 %n' | perl /usr/share/doc/samba-doc/examples/scripts/eventlog/parselog.pl
Modification of a read-only value attempted at /usr/share/doc/samba-doc/examples/scripts/eventlog/parselog.pl line 30, <> line 1.
emanuel@amd64 /tmp>>echo '1 1 1 1 %n' | perl /usr/share/doc/samba-doc/examples/scripts/eventlog/parselog.pl
Modification of a read-only value attempted at /usr/share/doc/samba-doc/examples/scripts/eventlog/parselog.pl line 30, <> line 1.

the bug can be found at :
    $outstr = sprintf "TMG: %d\nTMW: %d\nEID: 1000\nETP: INFO\nECT: 0\nRS2: 0\nCRN: 0\nUSL: 0\nSRC: Syslog\nSRN: $cname\nSTR: $ln\nDAT:\n\n",time(),time();

fix : use %s to $cname and $ln .
$outstr = sprintf "TMG: %d\nTMW: %d\nEID: 1000\nETP: INFO\nECT: 0\nRS2: 0\nCRN: 0\nUSL: 0\nSRC: Syslog\nSRN: %s\nSTR: %s\nDAT:\n\n",time(),time(),$cname,$ln;

[Serge Hallyn (serge-hallyn)]

Thanks for taking the time to submit this bug report and helping to make Ubuntu better.

I can reproduce this in oneiric, as well as confirm that your proposed fix works.
---
Ubuntu Bug Squad volunteer triager
http://wiki.ubuntu.com/BugSquad

[Kees Cook (kees)]

This looks like a regular bug to me. I don't think Perl will deal with the %n in an unsafe way.