When syslogd is reloading a modified config, it does a reexec on

itself.  For this it uses the original arguments of main().  The
function loghost_parse() modifies the optarg memory it is operating
on.  To prevent that the exec arguments have been tampered, pass a
copy of optarg to loghost_parse().
OK deraadt@

1 files changed, 8 insertions, 4 deletions

diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
index a65d6bf89e5..4e59a708f8d 100644
--- a/usr.sbin/syslogd/syslogd.c
+++ b/usr.sbin/syslogd/syslogd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: syslogd.c,v 1.178 2015/08/25 17:14:16 bluhm Exp $	*/
+/*	$OpenBSD: syslogd.c,v 1.179 2015/08/27 17:53:35 bluhm Exp $	*/
 
 /*
  * Copyright (c) 1983, 1988, 1993, 1994
@@ -393,12 +393,16 @@ main(int argc, char *argv[])
 			path_ctlsock = optarg;
 			break;
 		case 'T':		/* allow tcp and listen on address */
-			if (loghost_parse(optarg, NULL, &listen_host,
-			    &listen_port) == -1)
+			if ((p = strdup(optarg)) == NULL)
+				err(1, "strdup listen address");
+			if (loghost_parse(p, NULL, &listen_host, &listen_port)
+			    == -1)
 				errx(1, "bad listen address: %s", optarg);
 			break;
 		case 'U':		/* allow udp only from address */
-			if (loghost_parse(optarg, NULL, &bind_host, &bind_port)
+			if ((p = strdup(optarg)) == NULL)
+				err(1, "strdup bind address");
+			if (loghost_parse(p, NULL, &bind_host, &bind_port)
 			    == -1)
 				errx(1, "bad bind address: %s", optarg);
 			break;