From fbe823d9a61b5149cd6e3b5e17bd28dd3b8dd760 Mon Sep 17 00:00:00 2001 From: dormando Date: Fri, 20 Dec 2013 13:25:43 -0800 Subject: fix potential unbounded key prints item key isn't necessarily null terminated. user submitted a patch for one, this clears two more. --- items.c | 8 ++++++-- memcached.c | 10 ++++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/items.c b/items.c index d70400c..65b1a24 100644 --- a/items.c +++ b/items.c @@ -537,12 +537,16 @@ item *do_item_get(const char *key, const size_t nkey, const uint32_t hv) { int was_found = 0; if (settings.verbose > 2) { + int ii; if (it == NULL) { - fprintf(stderr, "> NOT FOUND %s", key); + fprintf(stderr, "> NOT FOUND "); } else { - fprintf(stderr, "> FOUND KEY %s", ITEM_key(it)); + fprintf(stderr, "> FOUND KEY "); was_found++; } + for (ii = 0; ii < nkey; ++ii) { + fprintf(stderr, "%c", key[ii]); + } } if (it != NULL) { diff --git a/memcached.c b/memcached.c index f7a140c..6486ff2 100644 --- a/memcached.c +++ b/memcached.c @@ -2856,8 +2856,14 @@ static inline void process_get_command(conn *c, token_t *tokens, size_t ntokens, } - if (settings.verbose > 1) - fprintf(stderr, ">%d sending key %s\n", c->sfd, ITEM_key(it)); + if (settings.verbose > 1) { + int ii; + fprintf(stderr, ">%d sending key ", c->sfd); + for (ii = 0; ii < it->nkey; ++ii) { + fprintf(stderr, "%c", key[ii]); + } + fprintf(stderr, "\n"); + } /* item_get() has incremented it->refcount for us */ pthread_mutex_lock(&c->thread->stats.mutex); -- cgit v1.2.1