--- ulogd.c
+++ ulogd.c	2007/03/20 13:21:29
@@ -595,14 +595,15 @@ static void sigterm_handler(int signal)
 
 	ipulog_destroy_handle(libulog_h);
 	free(libulog_buf);
-	if (logfile != stdout && logfile != &syslog_dummy)
-		fclose(logfile);
 
 	for (p = ulogd_outputs; p; p = p->next) {
 		if (p->fini)
 			(*p->fini)();
 	}
 
+	if (logfile != stdout && logfile != &syslog_dummy)
+		fclose(logfile);
+
 	exit(0);
 }
 
--- extensions/printpkt.h
+++ extensions/printpkt.h	2007/03/19 19:14:40
@@ -1,7 +1,7 @@
 #ifndef _PRINTPKT_H
 #define _PRINTPKT_H
 
-int printpkt_print(ulog_iret_t *res, char *buf, int prefix);
+int printpkt_print(ulog_iret_t *res, char *buf, size_t buf_siz, int prefix);
 int printpkt_init(void);
 
 #endif
--- extensions/printpkt.c
+++ extensions/printpkt.c	2007/03/19 19:14:40
@@ -95,13 +95,22 @@ static struct intr_id intr_ids[INTR_IDS]
 #define GET_VALUE(x)	ulogd_keyh[intr_ids[x].id].interp->result[ulogd_keyh[intr_ids[x].id].offset].value
 #define GET_FLAGS(x)	ulogd_keyh[intr_ids[x].id].interp->result[ulogd_keyh[intr_ids[x].id].offset].flags
 
-int printpkt_print(ulog_iret_t *res, char *buf, int prefix)
+int printpkt_print(ulog_iret_t *res, char *buf, size_t buf_siz, int prefix)
 {
 	char *timestr;
 	char *tmp;
 	time_t now;
 
-	char *buf_cur = buf;
+	if(buf_siz)
+		*buf = '\0';
+	else
+		return 1;
+
+#define BUF_ADD(ptr, siz, fmt...) \
+	do { \
+		size_t len=strlen(ptr);	\
+		snprintf(((ptr)+(len)), ((siz) > (len) ? (siz)-(len) : 0), ##fmt); \
+	} while(0)
 
 	if (prefix) {
 		now = (time_t) GET_VALUE(0).ui32;
@@ -116,127 +125,129 @@ int printpkt_print(ulog_iret_t *res, cha
 			*tmp = '\0';
 
 		/* print time and hostname */
-		buf_cur += sprintf(buf_cur, "%.15s %s", timestr, hostname);
+		BUF_ADD(buf, buf_siz, "%.15s %s", timestr, hostname);
 	}
 
-	if (*(char *) GET_VALUE(1).ptr)
-		buf_cur += sprintf(buf_cur, " %s", (char *) GET_VALUE(1).ptr);
+	if (*((char *) GET_VALUE(1).ptr))
+		BUF_ADD(buf, buf_siz, " %s", (char *) GET_VALUE(1).ptr);
 
-	buf_cur += sprintf(buf_cur," IN=%s OUT=%s ", 
+	BUF_ADD(buf, buf_siz, " IN=%s OUT=%s ", 
 			   (char *) GET_VALUE(2).ptr, 
 			   (char *) GET_VALUE(3).ptr);
 
 	/* FIXME: configurable */
-	buf_cur += sprintf(buf_cur, "MAC=%s ", 
+	BUF_ADD(buf, buf_siz, "MAC=%s ", 
 		(GET_FLAGS(4) & ULOGD_RETF_VALID) ? (char *) GET_VALUE(4).ptr : "");
 
-	buf_cur += sprintf(buf_cur, "SRC=%s ", 
+	BUF_ADD(buf, buf_siz, "SRC=%s ", 
 		       inet_ntoa((struct in_addr) {htonl(GET_VALUE(5).ui32)}));
-	buf_cur += sprintf(buf_cur, "DST=%s ", 
+	BUF_ADD(buf, buf_siz, "DST=%s ", 
 		       inet_ntoa((struct in_addr) {htonl(GET_VALUE(6).ui32)}));
 
-	buf_cur += sprintf(buf_cur,"LEN=%u TOS=%02X PREC=0x%02X TTL=%u ID=%u ", 
+	BUF_ADD(buf, buf_siz, "LEN=%u TOS=%02X PREC=0x%02X TTL=%u ID=%u ", 
 			GET_VALUE(7).ui16, GET_VALUE(8).ui8 & IPTOS_TOS_MASK, 
 			GET_VALUE(8).ui8 & IPTOS_PREC_MASK, GET_VALUE(9).ui8,
 			GET_VALUE(10).ui16);
 
 	if (GET_VALUE(10).ui16 & IP_RF) 
-		buf_cur += sprintf(buf_cur, "CE ");
+		BUF_ADD(buf, buf_siz, "CE ");
 
 	if (GET_VALUE(11).ui16 & IP_DF)
-		buf_cur += sprintf(buf_cur, "DF ");
+		BUF_ADD(buf, buf_siz, "DF ");
 
 	if (GET_VALUE(11).ui16 & IP_MF)
-		buf_cur += sprintf(buf_cur, "MF ");
+		BUF_ADD(buf, buf_siz, "MF ");
 
 	if (GET_VALUE(11).ui16 & IP_OFFMASK)
-		buf_cur += sprintf(buf_cur, "FRAG:%u ", 
+		BUF_ADD(buf, buf_siz, "FRAG:%u ", 
 				GET_VALUE(11).ui16 & IP_OFFMASK);
 
 	switch (GET_VALUE(12).ui8) {
 
 	case IPPROTO_TCP:
-		buf_cur += sprintf(buf_cur, "PROTO=TCP ");
-		buf_cur += sprintf(buf_cur, "SPT=%u DPT=%u ",
+		BUF_ADD(buf, buf_siz, "PROTO=TCP ");
+		BUF_ADD(buf, buf_siz, "SPT=%u DPT=%u ",
 				GET_VALUE(13).ui16, GET_VALUE(14).ui16);
 		/* FIXME: config */
-		buf_cur += sprintf(buf_cur, "SEQ=%u ACK=%u ", 
+		BUF_ADD(buf, buf_siz, "SEQ=%u ACK=%u ", 
 				GET_VALUE(15).ui32, GET_VALUE(16).ui32);
 
-		buf_cur += sprintf(buf_cur, "WINDOW=%u ", GET_VALUE(17).ui16);
+		BUF_ADD(buf, buf_siz, "WINDOW=%u ", GET_VALUE(17).ui16);
 
-//		buf_cur += sprintf(buf_cur, "RES=0x%02x ", 
+//		BUF_ADD(buf, buf_siz, "RES=0x%02x ", 
 		
 		if (GET_VALUE(18).b)
-			buf_cur += sprintf(buf_cur, "URG ");
+			BUF_ADD(buf, buf_siz, "URG ");
 
 		if (GET_VALUE(19).b)
-			buf_cur += sprintf(buf_cur, "ACK ");
+			BUF_ADD(buf, buf_siz, "ACK ");
 
 		if (GET_VALUE(20).b)
-			buf_cur += sprintf(buf_cur, "PSH ");
+			BUF_ADD(buf, buf_siz, "PSH ");
 
 		if (GET_VALUE(21).b)
-			buf_cur += sprintf(buf_cur, "RST ");
+			BUF_ADD(buf, buf_siz, "RST ");
 
 		if (GET_VALUE(22).b)
-			buf_cur += sprintf(buf_cur, "SYN ");
+			BUF_ADD(buf, buf_siz, "SYN ");
 
 		if (GET_VALUE(23).b)
-			buf_cur += sprintf(buf_cur, "FIN ");
+			BUF_ADD(buf, buf_siz, "FIN ");
 
-		buf_cur += sprintf(buf_cur, "URGP=%u ", GET_VALUE(24).ui16);
+		BUF_ADD(buf, buf_siz, "URGP=%u ", GET_VALUE(24).ui16);
 
 		break;
 	case IPPROTO_UDP:
 
-		buf_cur += sprintf(buf_cur, "PROTO=UDP ");
+		BUF_ADD(buf, buf_siz, "PROTO=UDP ");
 
-		buf_cur += sprintf(buf_cur, "SPT=%u DPT=%u LEN=%u ", 
+		BUF_ADD(buf, buf_siz, "SPT=%u DPT=%u LEN=%u ", 
 				GET_VALUE(25).ui16, GET_VALUE(26).ui16, 
 				GET_VALUE(27).ui16);
 			break;
 	case IPPROTO_ICMP:
 
-		buf_cur += sprintf(buf_cur, "PROTO=ICMP ");
+		BUF_ADD(buf, buf_siz, "PROTO=ICMP ");
 
-		buf_cur += sprintf(buf_cur, "TYPE=%u CODE=%u ",
+		BUF_ADD(buf, buf_siz, "TYPE=%u CODE=%u ",
 				GET_VALUE(28).ui8, GET_VALUE(29).ui8);
 
 		switch (GET_VALUE(28).ui8) {
 		case ICMP_ECHO:
 		case ICMP_ECHOREPLY:
-			buf_cur += sprintf(buf_cur, "ID=%u SEQ=%u ", 
+			BUF_ADD(buf, buf_siz, "ID=%u SEQ=%u ", 
 					   GET_VALUE(30).ui16,
 					   GET_VALUE(31).ui16);
 			break;
 		case ICMP_PARAMETERPROB:
-			buf_cur += sprintf(buf_cur, "PARAMETER=%u ",
+			BUF_ADD(buf, buf_siz, "PARAMETER=%u ",
 					   GET_VALUE(32).ui32 >> 24);
 			break;
 		case ICMP_REDIRECT:
-			buf_cur += sprintf(buf_cur, "GATEWAY=%s ", inet_ntoa((struct in_addr) {htonl(GET_VALUE(32).ui32)}));
+			BUF_ADD(buf, buf_siz, "GATEWAY=%s ", inet_ntoa((struct in_addr) {htonl(GET_VALUE(32).ui32)}));
 			break;
 		case ICMP_DEST_UNREACH:
 			if (GET_VALUE(29).ui8 == ICMP_FRAG_NEEDED)
-				buf_cur += sprintf(buf_cur, "MTU=%u ", 
+				BUF_ADD(buf, buf_siz, "MTU=%u ", 
 						   GET_VALUE(33).ui16);
 			break;
 		}
 		break;
 	case IPPROTO_ESP:
 	case IPPROTO_AH:
-		buf_cur += sprintf(buf_cur, "PROTO=%s ", GET_VALUE(12).ui8 == IPPROTO_ESP ? "ESP" : "AH");
+		BUF_ADD(buf, buf_siz, "PROTO=%s ", GET_VALUE(12).ui8 == IPPROTO_ESP ? "ESP" : "AH");
 		/* FIXME: "INCOMPLETE [%u bytes]" in case of short pkt */
 		if (intr_ids[34].id > 0) {
-			buf_cur += sprintf(buf_cur, "SPI=0x%x ", GET_VALUE(34).ui32);
+			BUF_ADD(buf, buf_siz, "SPI=0x%x ", GET_VALUE(34).ui32);
 		}
 		break;
 	default:
 
-		buf_cur += sprintf(buf_cur, "PROTO=%u ", GET_VALUE(12).ui8);
+		BUF_ADD(buf, buf_siz, "PROTO=%u ", GET_VALUE(12).ui8);
 	}
-	strcat(buf_cur, "\n");
+	BUF_ADD(buf, buf_siz, "\n");
+
+#undef  BUF_ADD
 
 	return 0;
 }
@@ -267,6 +278,7 @@ int printpkt_init(void)
 			  strerror(errno));
 		exit(2);
 	}
+	hostname[sizeof(hostname)-1] = '\0';
 
 	if (get_ids())
 		return 1;
--- extensions/ulogd_BASE.c
+++ extensions/ulogd_BASE.c	2007/03/20 15:55:27
@@ -32,6 +32,7 @@
 
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <sys/socket.h>
 #include <netinet/ip.h>
 #include <netinet/in.h>
@@ -63,11 +64,13 @@ static ulog_iret_t *_interp_raw(ulog_int
 {
 	unsigned char *p;
 	int i;
-	char *buf, *oldbuf = NULL;
+	char *buf, *ptr = NULL;
 	ulog_iret_t *ret = ip->result;
+	size_t siz;
 
 	if (pkt->mac_len) {
-		buf = (char *) malloc(3 * pkt->mac_len + 1);
+		siz = 3 * pkt->mac_len + 1;
+		buf = (char *) malloc(siz);
 		if (!buf) {
 			ulogd_log(ULOGD_ERROR, "OOM!!!\n");
 			return NULL;
@@ -75,9 +78,11 @@ static ulog_iret_t *_interp_raw(ulog_int
 		*buf = '\0';
 
 		p = pkt->mac;
-		oldbuf = buf;
-		for (i = 0; i < pkt->mac_len; i++, p++)
-			sprintf(buf, "%s%02x%c", oldbuf, *p, i==pkt->mac_len-1 ? ' ':':');
+		ptr = buf;
+		for (i = 0; i < pkt->mac_len; i++, p++) {
+			snprintf(ptr, siz-(ptr-buf), "%02x%s", *p, i==pkt->mac_len-1 ? "":":");
+			ptr = buf + strlen(buf);
+		}
 		ret[0].value.ptr = buf;
 		ret[0].flags |= ULOGD_RETF_VALID;
 	}
--- extensions/ulogd_LOCAL.c
+++ extensions/ulogd_LOCAL.c	2007/03/20 15:33:09
@@ -93,6 +93,7 @@ void _init(void)
 			  strerror(errno));
 		exit(2);
 	}
+	hostname[sizeof(hostname)-1] = '\0';
 	/* strip off everything after first '.' */
 	if ((tmp = strchr(hostname, '.')))
 		*tmp = '\0';
--- extensions/ulogd_LOGEMU.c
+++ extensions/ulogd_LOGEMU.c	2007/03/20 15:36:29
@@ -67,7 +67,7 @@ static int _output_logemu(ulog_iret_t *r
 {
 	static char buf[4096];
 
-	printpkt_print(res, buf, 1);
+	printpkt_print(res, buf, sizeof(buf), 1);
 
 	fprintf(of, "%s", buf);
 
@@ -79,15 +79,18 @@ static int _output_logemu(ulog_iret_t *r
 
 static void signal_handler_logemu(int signal)
 {
+	FILE *old=of;
+
 	switch (signal) {
 	case SIGHUP:
 		ulogd_log(ULOGD_NOTICE, "syslogemu: reopening logfile\n");
-		fclose(of);
 		of = fopen64(syslogf_ce.u.string, "a");
 		if (!of) {
 			ulogd_log(ULOGD_FATAL, "can't open syslogemu: %s\n",
 				strerror(errno));
-			exit(2);
+			of=old;
+		} else {
+			fclose(old);
 		}
 		break;
 	default:
--- extensions/ulogd_OPRINT.c
+++ extensions/ulogd_OPRINT.c	2007/03/20 15:36:04
@@ -48,7 +48,7 @@ static FILE *of = NULL;
 static int _output_print(ulog_iret_t *res)
 {
 	ulog_iret_t *ret;
-	
+
 	fprintf(of, "===>PACKET BOUNDARY\n");
 	for (ret = res; ret; ret = ret->cur_next) {
 		fprintf(of,"%s=", ret->key);
@@ -72,7 +72,10 @@ static int _output_print(ulog_iret_t *re
 					HIPQUAD(ret->value.ui32));
 				break;
 			case ULOGD_RET_NONE:
-				fprintf(of, "<none>");
+				fprintf(of, "<none>\n");
+				break;
+			default:
+				fprintf(of, "\n");
 				break;
 		}
 	}
@@ -88,16 +91,18 @@ static config_entry_t outf_ce = { 
 
 static void sighup_handler_print(int signal)
 {
+	FILE *old=of;
 
 	switch (signal) {
 	case SIGHUP:
 		ulogd_log(ULOGD_NOTICE, "PKTLOG: reopening logfile\n");
-		fclose(of);
 		of = fopen64(outf_ce.u.string, "a");
 		if (!of) {
 			ulogd_log(ULOGD_FATAL, "can't open PKTLOG: %s\n",
 				strerror(errno));
-			exit(2);
+			of=old;
+		} else {
+			fclose(old);
 		}
 		break;
 	default:
--- extensions/ulogd_PWSNIFF.c
+++ extensions/ulogd_PWSNIFF.c	2007/03/19 19:14:40
@@ -116,7 +116,7 @@ static ulog_iret_t *_interp_pwsniff(ulog
 			return NULL;
 		}
 		strncpy(ret[0].value.ptr, (char *)begp, len);
-		*((char *)ret[0].value.ptr + len + 1) = '\0';
+		*((char *)ret[0].value.ptr + len) = '\0';
 	}
 	if (pw_len) {
 		ret[1].value.ptr = (char *) malloc(pw_len+1);
@@ -126,7 +126,7 @@ static ulog_iret_t *_interp_pwsniff(ulog
 			return NULL;
 		}
 		strncpy(ret[1].value.ptr, (char *)pw_begp, pw_len);
-		*((char *)ret[1].value.ptr + pw_len + 1) = '\0';
+		*((char *)ret[1].value.ptr + pw_len) = '\0';
 
 	}
 	return ret;
--- extensions/ulogd_SYSLOG.c
+++ extensions/ulogd_SYSLOG.c	2007/03/19 19:14:40
@@ -61,7 +61,7 @@ static int _output_syslog(ulog_iret_t *r
 {
 	static char buf[4096];
 	
-	printpkt_print(res, buf, 0);
+	printpkt_print(res, buf, sizeof(buf), 0);
 	syslog(syslog_level|syslog_facility, buf);
 
 	return 0;