Changed to using sqlite3_vmprintf() function instead of vsnprintf()

2 files changed, 34 insertions, 33 deletions

diff --git a/database/sqlite/eurephiadb-sqlite.c b/database/sqlite/eurephiadb-sqlite.c
index b1294ed..29998c6 100644
--- a/database/sqlite/eurephiadb-sqlite.c
+++ b/database/sqlite/eurephiadb-sqlite.c
@@ -82,7 +82,7 @@ void update_attempts(eurephiaCTX *ctx, const char *blid) {
         if( blid != NULL ) {
                 res = sqlite_query(ctx, 
                                    "UPDATE openvpn_blacklist "
-                                   "   SET last_accessed = CURRENT_TIMESTAMP WHERE blid = %s", blid);
+                                   "   SET last_accessed = CURRENT_TIMESTAMP WHERE blid = %q", blid);
                 if( res == NULL ) {
                         eurephia_log(ctx, LOG_CRITICAL, 0, 
                                      "Could not update openvpn_blacklist.last_accessed for blid=%s", blid);
@@ -197,8 +197,8 @@ int eDBauth_TLS(eurephiaCTX *ctx, const char *org, const char *cname, const char
                            "SELECT cert.certid, blid "
                            "  FROM openvpn_certificates cert"
                            "  LEFT JOIN openvpn_blacklist bl USING(digest)"
-                           " WHERE organisation='%s' AND common_name='%s' "
-                           "      AND email='%s' AND depth='%s' AND cert.digest='%s'%c",
+                           " WHERE organisation='%q' AND common_name='%q' "
+                           "      AND email='%q' AND depth='%q' AND cert.digest='%q'%c",
                            org, cname, email, depth, digest, 0);
 
         if( res != NULL ) {
@@ -261,7 +261,7 @@ int eDBauth_user(eurephiaCTX *ctx, const int certid, const char *username, const
                            "  LEFT JOIN (SELECT blid, certid "
                            "               FROM openvpn_certificates "
                            "               JOIN openvpn_blacklist USING(digest)) bl2 ON(uc.certid = bl2.certid)"
-                           " WHERE uc.certid = '%i' AND ou.username = '%s'",
+                           " WHERE uc.certid = '%i' AND ou.username = '%q'",
                            crpwd, certid, username);
         free_nullsafe(crpwd);
         if( res == NULL ) {
@@ -329,7 +329,7 @@ int eDBget_uid(eurephiaCTX *ctx, const int certid, const char *username)
                            "SELECT uid "
                            "  FROM openvpn_usercerts "
                            "  JOIN openvpn_users USING (uid) "
-                           " WHERE certid = '%i' AND username = '%s'",
+                           " WHERE certid = '%i' AND username = '%q'",
                            certid, username);
         if( (res == NULL) || (sqlite_get_numtuples(res) != 1) ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, "Could not lookup userid for user '%s'", username);
@@ -353,7 +353,7 @@ int eDBblacklist_check(eurephiaCTX *ctx, const int type, const char *val)
         eurephia_log(ctx, LOG_DEBUG, 10, "Function call: eDBblacklist_check(ctx, '%s', '%s')", 
                      eDBattempt_types[type].descr, val);
 
-        blr  = sqlite_query(ctx, "SELECT blid FROM openvpn_blacklist WHERE %s = '%s'", 
+        blr  = sqlite_query(ctx, "SELECT blid FROM openvpn_blacklist WHERE %s = '%q'", 
                             eDBattempt_types[type].colname, val);
         if( blr != NULL ) {
                 blid = strdup_nullsafe(sqlite_get_value(blr, 0, 0));
@@ -376,7 +376,7 @@ int eDBblacklist_check(eurephiaCTX *ctx, const int type, const char *val)
                 // Check if this [type] has been attempted earlier - if it has reaced the maximum 
                 // attempt limit, blacklist it
                 atpr = sqlite_query(ctx, 
-                                    "SELECT atpid, attempts >= %s FROM openvpn_attempts WHERE %s= '%s'",
+                                    "SELECT atpid, attempts >= %q FROM openvpn_attempts WHERE %s = '%q'",
                                     eGet_value(ctx->dbc->config, eDBattempt_types[type].allow_cfg),
                                     eDBattempt_types[type].colname, val);
                 if( atpr != NULL ) {
@@ -391,7 +391,7 @@ int eDBblacklist_check(eurephiaCTX *ctx, const int type, const char *val)
                                              "%s got BLACKLISTED due to too many failed attempts: %s", 
                                              eDBattempt_types[type].descr, val);
                                 blr = sqlite_query(ctx, 
-                                                   "INSERT INTO openvpn_blacklist (%s) VALUES ('%s')", 
+                                                   "INSERT INTO openvpn_blacklist (%s) VALUES ('%q')", 
                                                    eDBattempt_types[type].colname, val);
                                 if( blr == NULL ) {
                                         eurephia_log(ctx, LOG_CRITICAL, 0, 
@@ -434,7 +434,7 @@ void eDBregister_attempt(eurephiaCTX *ctx, int type, int mode, const char *value
                            "SELECT atpid, attempts > %s, blid, attempts "
                            "  FROM openvpn_attempts "
                            "  LEFT JOIN openvpn_blacklist USING(%s)"
-                           " WHERE %s = '%s'",
+                           " WHERE %s = '%q'",
                            eGet_value(ctx->dbc->config, eDBattempt_types[type].allow_cfg),
                            eDBattempt_types[type].colname,
                            eDBattempt_types[type].colname, value);
@@ -458,7 +458,7 @@ void eDBregister_attempt(eurephiaCTX *ctx, int type, int mode, const char *value
 
         if( (id == NULL) && (mode == ATTEMPT_REGISTER) ) {
                 // Only insert record when we are in registering mode
-                res = sqlite_query(ctx, "INSERT INTO openvpn_attempts (%s, attempts) VALUES ('%s', 1)",
+                res = sqlite_query(ctx, "INSERT INTO openvpn_attempts (%s, attempts) VALUES ('%q', 1)",
                                    eDBattempt_types[type].colname, value);
         } else if( id != NULL ){
                 // if a attempt record exists, update it according to mode
@@ -467,13 +467,13 @@ void eDBregister_attempt(eurephiaCTX *ctx, int type, int mode, const char *value
                         res = sqlite_query(ctx,
                                            "UPDATE openvpn_attempts "
                                            "   SET attempts = 0 "
-                                           " WHERE atpid = %s", id);
+                                           " WHERE atpid = '%q'", id);
                         break;
                 default:
                         res = sqlite_query(ctx,
                                            "UPDATE openvpn_attempts "
                                            "   SET last_attempt = CURRENT_TIMESTAMP, attempts = attempts + 1"
-                                           " WHERE atpid = %s", id);
+                                           " WHERE atpid = '%q'", id);
                         break;
                 }
         }
@@ -489,7 +489,7 @@ void eDBregister_attempt(eurephiaCTX *ctx, int type, int mode, const char *value
             && (blid == NULL) && (atmpt_block != NULL) && (atoi_nullsafe(atmpt_block) > 0) ) {
                 eurephia_log(ctx, LOG_WARNING, 0, "Blacklisting %s due to too many attempts: %s",
                              eDBattempt_types[type].descr, value);
-                res = sqlite_query(ctx, "INSERT INTO openvpn_blacklist (%s) VALUES ('%s')",
+                res = sqlite_query(ctx, "INSERT INTO openvpn_blacklist (%s) VALUES ('%q')",
                                    eDBattempt_types[type].colname, value);
                 if( res == NULL ) {
                         eurephia_log(ctx, LOG_CRITICAL, 0, 
@@ -525,7 +525,7 @@ int eDBregister_login(eurephiaCTX *ctx, eurephiaSESSION *skey, const int certid,
                            "                             protocol, remotehost, remoteport,"
                            "                             vpnipaddr, vpnipmask,"
                            "                             sessionstatus, sessionkey, login) "
-                           "VALUES (%i, %i, '%s','%s','%s','%s','%s', 1,'%s', CURRENT_TIMESTAMP)",
+                           "VALUES (%i, %i, '%q','%q','%q','%q','%q', 1,'%q', CURRENT_TIMESTAMP)",
                            uid, certid, proto, remipaddr, remport, vpnipaddr, vpnipmask, skey->sessionkey);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, "Could not insert new session into openvpn_lastlog");
@@ -551,8 +551,8 @@ int eDBregister_vpnmacaddr(eurephiaCTX *ctx, eurephiaSESSION *session, const cha
         }
 
         res = sqlite_query(ctx, 
-                           "UPDATE openvpn_lastlog SET sessionstatus = 2, macaddr = '%s' "
-                           " WHERE sessionkey = '%s' AND sessionstatus = 1", macaddr, session->sessionkey);
+                           "UPDATE openvpn_lastlog SET sessionstatus = 2, macaddr = '%q' "
+                           " WHERE sessionkey = '%q' AND sessionstatus = 1", macaddr, session->sessionkey);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, "Could not update lastlog with new MAC address for session");
                 return 0;
@@ -583,7 +583,7 @@ int eDBregister_logout(eurephiaCTX *ctx, eurephiaSESSION *skey,
                            "UPDATE openvpn_lastlog "
                            "   SET sessionstatus = 3, logout = CURRENT_TIMESTAMP, "
                            "       bytes_sent = '%i', bytes_received = '%i' "
-                           " WHERE sessionkey = '%s' AND sessionstatus = 2",
+                           " WHERE sessionkey = '%q' AND sessionstatus = 2",
                            atoi_nullsafe(bytes_sent), atoi_nullsafe(bytes_received), skey->sessionkey);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, "Could not update lastlog with logout information (%s)",
@@ -608,7 +608,7 @@ char *eDBget_sessionkey(eurephiaCTX *ctx, const char *sessionseed) {
                              "eDBget_sessionkey: No session seed given - cannot locate sessionkey");
                 return NULL;
         }
-        res = sqlite_query(ctx, "SELECT sessionkey FROM openvpn_sessionkeys WHERE sessionseed = '%s'", 
+        res = sqlite_query(ctx, "SELECT sessionkey FROM openvpn_sessionkeys WHERE sessionseed = '%q'", 
                            sessionseed);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0,"Could not retrieve sessionkey from openvpn_sessionkeys (%s)",
@@ -637,7 +637,7 @@ int eDBcheck_sessionkey_uniqueness(eurephiaCTX *ctx, const char *seskey) {
                 return 0;
         }
 
-        res = sqlite_query(ctx, "SELECT count(sessionkey) = 0 FROM openvpn_lastlog WHERE sessionkey = '%s'", seskey);
+        res = sqlite_query(ctx, "SELECT count(sessionkey) = 0 FROM openvpn_lastlog WHERE sessionkey = '%q'", seskey);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, 
                              "eDBcheck_sessionkey_uniqness: Could not check uniqueness of sessionkey");
@@ -661,7 +661,7 @@ int eDBregister_sessionkey(eurephiaCTX *ctx, const char *seed, const char *seske
         }
 
         res = sqlite_query(ctx, 
-                           "INSERT INTO openvpn_sessionkeys (sessionseed, sessionkey) VALUES('%s','%s')",
+                           "INSERT INTO openvpn_sessionkeys (sessionseed, sessionkey) VALUES('%q','%q')",
                            seed, seskey);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, 
@@ -683,7 +683,7 @@ int eDBremove_sessionkey(eurephiaCTX *ctx, const char *seskey) {
                 return 0;
         }
 
-        res = sqlite_query(ctx, "DELETE FROM openvpn_sessionkeys WHERE sessionkey = '%s'", seskey);
+        res = sqlite_query(ctx, "DELETE FROM openvpn_sessionkeys WHERE sessionkey = '%q'", seskey);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, 
                              "eDBremove_sessionkey: Error removing sessionkey from openvpn_sessionkeys");
@@ -707,7 +707,7 @@ eurephiaVALUES *eDBload_sessiondata(eurephiaCTX *ctx, const char *sesskey) {
 
         sessvals = eCreate_value_space(ctx, 10);
 
-        res = sqlite_query(ctx, "SELECT datakey, dataval FROM openvpn_sessions WHERE sessionkey = '%s'", 
+        res = sqlite_query(ctx, "SELECT datakey, dataval FROM openvpn_sessions WHERE sessionkey = '%q'", 
                            sesskey);
         if( (res != NULL) || (sqlite_get_numtuples(res) > 0)  ) {
                 for( i = 0; i < sqlite_get_numtuples(res); i++ ) {
@@ -743,7 +743,7 @@ int eDBstore_session_value(eurephiaCTX *ctx, eurephiaSESSION *session, int mode,
         case SESSVAL_NEW:
                 res = sqlite_query(ctx, 
                                    "INSERT INTO openvpn_sessions (sessionkey, datakey, dataval) "
-                                   "VALUES ('%s','%s','%s')", session->sessionkey, key, val);
+                                   "VALUES ('%q','%q','%q')", session->sessionkey, key, val);
                 if( res == NULL ) {
                         eurephia_log(ctx, LOG_CRITICAL, 0, 
                                      "Could not register new session variable into database: [%s] %s = %s",
@@ -754,8 +754,8 @@ int eDBstore_session_value(eurephiaCTX *ctx, eurephiaSESSION *session, int mode,
 
         case SESSVAL_UPDATE:
                 res = sqlite_query(ctx, 
-                                   "UPDATE openvpn_sessions SET dataval = '%s' "
-                                   " WHERE sessionkey = '%s' AND datakey = '%s'", val, session->sessionkey, key);
+                                   "UPDATE openvpn_sessions SET dataval = '%q' "
+                                   " WHERE sessionkey = '%q' AND datakey = '%q'", val, session->sessionkey, key);
                 if( res == NULL ) {
                         eurephia_log(ctx, LOG_CRITICAL, 0, "Could not update session variable: [%s] %s = %s ",
                                      session->sessionkey, key, val);
@@ -764,7 +764,7 @@ int eDBstore_session_value(eurephiaCTX *ctx, eurephiaSESSION *session, int mode,
                 break;
 
         case SESSVAL_DELETE:
-                res = sqlite_query(ctx, "DELETE FROM openvpn_sessions WHERE sessionkey = '%s' AND datakey = '%s'",
+                res = sqlite_query(ctx, "DELETE FROM openvpn_sessions WHERE sessionkey = '%q' AND datakey = '%q'",
                                    session->sessionkey, key);                                   
                 if( res == NULL ) {
                         eurephia_log(ctx, LOG_CRITICAL, 0, "Could not delete session variable: [%s] %s",
@@ -794,7 +794,7 @@ int eDBdestroy_session(eurephiaCTX *ctx, const char *macaddr)
         res = sqlite_query(ctx, 
                            "SELECT sessionkey "
                            "  FROM openvpn_sessions "
-                           " WHERE datakey = 'macaddr' AND dataval = '%'s'", macaddr);
+                           " WHERE datakey = 'macaddr' AND dataval = '%q'", macaddr);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, 
                              "Could not remove session from database (MAC addr: %s)", macaddr);
@@ -814,7 +814,7 @@ int eDBdestroy_session(eurephiaCTX *ctx, const char *macaddr)
         res = sqlite_query(ctx, 
                            "UPDATE openvpn_lastlog "
                            "   SET sessionstatus = 4, session_del = CURRENT_TIMESTAMP "
-                           " WHERE sessionkey = '%s' AND sessionstatus = 3", skey);
+                           " WHERE sessionkey = '%q' AND sessionstatus = 3", skey);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, 
                              "Could not update session status in lastlog (%s/%s))", skey, macaddr);
@@ -824,7 +824,7 @@ int eDBdestroy_session(eurephiaCTX *ctx, const char *macaddr)
         sqlite_free_results(res);
 
         // Delete session variables
-        res = sqlite_query(ctx, "DELETE FROM openvpn_sessions WHERE sessionkey = '%s'", skey);
+        res = sqlite_query(ctx, "DELETE FROM openvpn_sessions WHERE sessionkey = '%q'", skey);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, 
                              "Could not delete session variables (%s/%s))", skey, macaddr);
@@ -857,7 +857,7 @@ char *eDBget_fw_profile(eurephiaCTX *ctx, eurephiaSESSION *session)
                            "  FROM openvpn_lastlog "
                            "  JOIN openvpn_usercerts USING(certid, uid)"
                            "  JOIN openvpn_accesses USING(accessprofile)"
-                           " WHERE sessionkey = '%s'", session->sessionkey);
+                           " WHERE sessionkey = '%q'", session->sessionkey);
         if( res == NULL ) {
                 eurephia_log(ctx, LOG_CRITICAL, 0, "Could not retrieve firewall profile for session '%s'",
                              session->sessionkey);
diff --git a/database/sqlite/sqlite.c b/database/sqlite/sqlite.c
index 9be9758..c58aa01 100644
--- a/database/sqlite/sqlite.c
+++ b/database/sqlite/sqlite.c
@@ -197,7 +197,7 @@ static int _cb_parse_result(void *NotUsed, int argc, char **argv, char **colName
 dbresult *sqlite_query(eurephiaCTX *ctx, char *fmt, ... ) { 
         int rc;
         va_list ap;
-        char *errMsg = NULL, sql[65538];
+        char *errMsg = NULL, *sql = NULL;
         eDBconn *dbc = ctx->dbc;
 
         if( ctx->dbc == NULL ) {
@@ -214,20 +214,21 @@ dbresult *sqlite_query(eurephiaCTX *ctx, char *fmt, ... ) {
         glob_results->num_tuples = 0;
         
         // prepare SQL query
-        memset(&sql, 0, 65538);
         va_start(ap, fmt);
-        vsnprintf(sql, 65535, fmt, ap);
+        sql = sqlite3_vmprintf(fmt, ap);
         va_end(ap);
 
         eurephia_log(ctx, LOG_DEBUG, 11, "Doing SQL Query: %s", sql);
         rc = sqlite3_exec( (sqlite3 *) dbc->dbhandle, sql, _cb_parse_result, 0, &errMsg );
         if( rc != SQLITE_OK ) {
                 eurephia_log(ctx, LOG_ERROR, 0, "SQL Error: %s", errMsg);
+                sqlite3_free(sql); sql = NULL;
                 return NULL;
         }
 
         glob_results->srch_tuples = glob_results->tuples;
         glob_results->srch_headerrec = glob_results->headerrec;
+        sqlite3_free(sql); sql = NULL;
 
         return glob_results;
 }