1 files changed, 19 insertions, 8 deletions

diff --git a/pr/src/io/prlog.c b/pr/src/io/prlog.c
index 16f68823..ac1c5492 100644
--- a/pr/src/io/prlog.c
+++ b/pr/src/io/prlog.c
@@ -194,13 +194,16 @@ void _PR_InitLog(void)
 
     ev = PR_GetEnv("NSPR_LOG_MODULES");
     if (ev && ev[0]) {
-        char module[64];
+        char module[64];  /* Security-Critical: If you change this
+                           * size, you must also change the sscanf
+                           * format string to be size-1.
+                           */
         PRBool isSync = PR_FALSE;
         PRIntn evlen = strlen(ev), pos = 0;
         PRInt32 bufSize = DEFAULT_BUF_SIZE;
         while (pos < evlen) {
             PRIntn level = 1, count = 0, delta = 0;
-            count = sscanf(&ev[pos], "%64[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]%n:%d%n",
+            count = sscanf(&ev[pos], "%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]%n:%d%n",
                            module, &delta, &level, &delta);
             pos += delta;
             if (count == 0) break;
@@ -232,7 +235,7 @@ void _PR_InitLog(void)
             /*found:*/
             count = sscanf(&ev[pos], " , %n", &delta);
             pos += delta;
-            if (count == -1) break;
+            if (count == EOF) break;
         }
         PR_SetLogBuffering(isSync ? bufSize : 0);
 
@@ -277,11 +280,16 @@ void _PR_LogCleanup(void)
 
     while (lm != NULL) {
         PRLogModuleInfo *next = lm->next;
-        PR_Free((/*const*/ char *)lm->name);
+        free((/*const*/ char *)lm->name);
         PR_Free(lm);
         lm = next;
     }
     logModules = NULL;
+
+    if (_pr_logLock) {
+        PR_DestroyLock(_pr_logLock);
+        _pr_logLock = NULL;
+    }
 }
 
 static void _PR_SetLogModuleLevel( PRLogModuleInfo *lm )
@@ -290,12 +298,15 @@ static void _PR_SetLogModuleLevel( PRLogModuleInfo *lm )
 
     ev = PR_GetEnv("NSPR_LOG_MODULES");
     if (ev && ev[0]) {
-        char module[64];
+        char module[64];  /* Security-Critical: If you change this
+                           * size, you must also change the sscanf
+                           * format string to be size-1.
+                           */
         PRIntn evlen = strlen(ev), pos = 0;
         while (pos < evlen) {
             PRIntn level = 1, count = 0, delta = 0;
 
-            count = sscanf(&ev[pos], "%64[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]%n:%d%n",
+            count = sscanf(&ev[pos], "%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]%n:%d%n",
                            module, &delta, &level, &delta);
             pos += delta;
             if (count == 0) break;
@@ -314,7 +325,7 @@ static void _PR_SetLogModuleLevel( PRLogModuleInfo *lm )
             }
             count = sscanf(&ev[pos], " , %n", &delta);
             pos += delta;
-            if (count == -1) break;
+            if (count == EOF) break;
         }
     }
 } /* end _PR_SetLogModuleLevel() */
@@ -361,7 +372,7 @@ PR_IMPLEMENT(PRBool) PR_SetLogFile(const char *file)
 #else
     PRFileDesc *newLogFile;
 
-    newLogFile = PR_Open(file, PR_WRONLY|PR_CREATE_FILE, 0666);
+    newLogFile = PR_Open(file, PR_WRONLY|PR_CREATE_FILE|PR_TRUNCATE, 0666);
     if (newLogFile) {
         if (logFile && logFile != _pr_stdout && logFile != _pr_stderr) {
             PR_Close(logFile);