- don't try to allocate buffers (which can be pretty large now) off the stack

- fix use of format specifiers for arguments we don't have when logging

1 files changed, 48 insertions, 22 deletions

diff --git a/src/format.c b/src/format.c
index 6138207..db71709 100644
--- a/src/format.c
+++ b/src/format.c
@@ -545,7 +545,7 @@ format_match_generic(struct plugin_state *state,
 			slapi_log_error(SLAPI_LOG_PLUGIN,
 					state->plugin_desc->spd_id,
 					"%s: no matching values for "
-					"\"%s\", and no default value \"%s\"\n",
+					"\"%s\", and no default value\n",
 					fnname, argv[1]);
 			if (values != NULL) {
 				slapi_vattr_values_free(&values, &actual_attr,
@@ -571,7 +571,7 @@ format_match_generic(struct plugin_state *state,
 			slapi_log_error(SLAPI_LOG_PLUGIN,
 					state->plugin_desc->spd_id,
 					"%s: too many matching values for "
-					"\"%s\", and no default value \"%s\"\n",
+					"\"%s\", and no default value\n",
 					fnname, argv[1]);
 			if (values != NULL) {
 				slapi_vattr_values_free(&values, &actual_attr,
@@ -747,13 +747,20 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	int exp_len, level;
 	const char *fmtstart, *fmtend, *match, *attribute;
 	char *tmp, *fnname, *spd_id;
-	char exp[outbuf_len * 2];
+	char *expr;
 	const char *default_value, *alternate_value, *paramstart, *paramend;
 	size_t spn;
 	int (*formatfn)(struct plugin_state *state,
 		        Slapi_PBlock *pb, Slapi_Entry *e, const char *args,
 		        char *outbuf, int outbuf_len, char ***visited_ndns);
 
+	expr = malloc(outbuf_len * 2);
+	if (expr == NULL) {
+		slapi_log_error(SLAPI_LOG_PLUGIN, spd_id,
+				"expansion failed: out of memory\n");
+		return -1;
+	}
+
 	/* First, expand any subexpressions and call any "functions". */
 	spd_id = state->plugin_desc->spd_id;
 	level = 0;
@@ -767,7 +774,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			switch (fmt[i + 1]) {
 			case '%':
 				/* It's just an escaped "%". */
-				exp[j++] = '%';
+				expr[j++] = '%';
 				i += 2;
 				continue;
 				break;
@@ -781,6 +788,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 							spd_id,
 							"expansion failed: "
 							"no closing brace\n");
+					free(expr);
 					return -1;
 				} else {
 					/* Mark the first character after the
@@ -794,6 +802,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 								"expansion "
 								"failed: out "
 								"of memory\n");
+						free(expr);
 						return -1;
 					}
 					memcpy(tmp, fmtstart + 2,
@@ -803,8 +812,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 					 * subexpression. */
 					exp_len = format_expand(state, pb, e,
 								tmp,
-								exp + j,
-								sizeof(exp) - j,
+								expr + j,
+								sizeof(expr) - j,
 								visited_ndns,
 								FALSE);
 					if (exp_len < 0) {
@@ -817,10 +826,11 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 								"->%s<-\n",
 								tmp);
 						free(tmp);
+						free(expr);
 						return -1;
 					}
 					free(tmp);
-					if (exp_len + j >= (int) sizeof(exp)) {
+					if (exp_len + j >= (int) sizeof(expr)) {
 						/* Out of space, FAIL. */
 						slapi_log_error(SLAPI_LOG_PLUGIN,
 								spd_id,
@@ -828,6 +838,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 								"failed: result"
 								" would be too "
 								"big\n");
+						free(expr);
 						return -1;
 					} else {
 						/* It fit, so keep going. */
@@ -848,6 +859,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 							"expansion failed: "
 							"bad function "
 							"invocation\n");
+					free(expr);
 					return -1;
 				}
 				if (*paramstart == '{') {
@@ -864,6 +876,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 							"expansion failed: "
 							"bad function "
 							"invocation\n");
+					free(expr);
 					return -1;
 				}
 				fnname = malloc(paramstart - (fmt + i));
@@ -873,6 +886,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 							spd_id,
 							"expansion failed: "
 							"out of memory\n");
+					free(expr);
 					return -1;
 				}
 				memcpy(fnname, fmt + i + 1,
@@ -887,6 +901,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 							"expansion failed: "
 							"out of memory\n");
 					free(fnname);
+					free(expr);
 					return -1;
 				}
 				memcpy(tmp, paramstart + 1,
@@ -903,11 +918,13 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 							"defined\n", fnname);
 					free(fnname);
 					free(tmp);
+					free(expr);
 					return -1;
 				}
 				/* Call the "function". */
 				exp_len = (*formatfn)(state, pb, e, tmp,
-						      exp + j, sizeof(exp) - j,
+						      expr + j,
+						      sizeof(expr) - j,
 						      visited_ndns);
 				free(tmp);
 				if (exp_len < 0) {
@@ -919,10 +936,11 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 							"'%s' failed\n",
 							fnname);
 					free(fnname);
+					free(expr);
 					return -1;
 				}
 				free(fnname);
-				if (exp_len + j >= (int) sizeof(exp)) {
+				if (exp_len + j >= (int) sizeof(expr)) {
 					/* We'd be out of space, FAIL. */
 					slapi_log_error(SLAPI_LOG_PLUGIN,
 							spd_id,
@@ -930,6 +948,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 							"failed: result"
 							" would be too "
 							"big\n");
+					free(expr);
 					return -1;
 				}
 				i = (paramend - fmt) + 1;
@@ -940,27 +959,28 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			break;
 		default:
 			/* Default is just a literal character. */
-			exp[j++] = fmt[i++];
+			expr[j++] = fmt[i++];
 			break;
 		}
 	}
-	exp[j] = '\0';
+	expr[j] = '\0';
 
 	if (literal) {
 		/* It's a literal string, so we're actually done. */
-		i = strlen(exp);
+		i = strlen(expr);
 		if (i <= outbuf_len) {
-			memcpy(outbuf, exp, i);
+			memcpy(outbuf, expr, i);
 		}
+		free(expr);
 		return i;
 	} else {
 		/* It's an expression, so evaluate it.  Check if it uses a
 		 * default/alternate value. */
-		spn = strcspn(exp, ":");
-		if (spn == strlen(exp)) {
+		spn = strcspn(expr, ":");
+		if (spn == strlen(expr)) {
 			/* Simple expression: expect it to be a single-valued
 			 * attribute. */
-			tmp = format_single(pb, e, exp, visited_ndns);
+			tmp = format_single(pb, e, expr, visited_ndns);
 			if (tmp != NULL) {
 				/* Copy the string to the output buffer if
 				 * there's space for it. */
@@ -971,28 +991,30 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 				free(tmp);
 				/* Return the length of the expanded
 				 * expression. */
+				free(expr);
 				return i;
 			} else {
 				/* No value found? FAIL. */
+				free(expr);
 				return -1;
 			}
 		} else {
 			/* Make a copy of the attribute name. */
-			exp[spn] = '\0';
-			attribute = exp;
+			expr[spn] = '\0';
+			attribute = expr;
 			alternate_value = NULL;
 			default_value = NULL;
 			/* Figure out if there's an alternate or default value
 			 * given. */
-			switch (exp[spn + 1]) {
+			switch (expr[spn + 1]) {
 			case '+':
-				alternate_value = exp + spn + 2;
+				alternate_value = expr + spn + 2;
 				break;
 			case '-':
-				default_value = exp + spn + 2;
+				default_value = expr + spn + 2;
 				break;
 			default:
-				default_value = exp + spn + 1;
+				default_value = expr + spn + 1;
 				break;
 			}
 			/* Retrieve the value. */
@@ -1007,9 +1029,11 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 						memcpy(outbuf, default_value,
 						       i);
 					}
+					free(expr);
 					return i;
 				} else {
 					/* No value, and no default: FAIL. */
+					free(expr);
 					return -1;
 				}
 			} else {
@@ -1023,6 +1047,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 						       i);
 					}
 					free(tmp);
+					free(expr);
 					return i;
 				} else {
 					/* Supply the looked-up value. */
@@ -1031,6 +1056,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 						memcpy(outbuf, tmp, i);
 					}
 					free(tmp);
+					free(expr);
 					return i;
 				}
 			}