From a469cbf7dce3ab124fc08b7ded7326d947f018b2 Mon Sep 17 00:00:00 2001
From: deraadt <deraadt@openbsd.org>
Date: Wed, 17 Aug 2016 18:07:07 +0000
Subject: [PATCH] Generate syslog warnings for %s fmt strings NULL to "(null)"
 conversions. Over time we can repair software which performs this
 non-standard behaviour, and fix bugs along the way.  Let's first find out how
 bad the situation is by deploying this in snapshots.

This type of logging is possible because OpenBSD syslog_r(3) -> sendsyslog(2)
is side-effect free enough to be used in the bowels of libc.

ok tedu
---
 lib/libc/stdio/vfprintf.c  | 20 ++++++++++++++++++--
 lib/libc/stdio/vfwprintf.c | 23 ++++++++++++++++++++---
 2 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/lib/libc/stdio/vfprintf.c b/lib/libc/stdio/vfprintf.c
index 252b7b84466..9865c1e4c72 100644
--- a/lib/libc/stdio/vfprintf.c
+++ b/lib/libc/stdio/vfprintf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfprintf.c,v 1.73 2016/06/06 17:22:59 millert Exp $	*/
+/*	$OpenBSD: vfprintf.c,v 1.74 2016/08/17 18:07:07 deraadt Exp $	*/
 /*-
  * Copyright (c) 1990 The Regents of the University of California.
  * All rights reserved.
@@ -50,6 +50,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <syslog.h>
 #include <wchar.h>
 
 #include "local.h"
@@ -857,6 +858,13 @@ fp_common:
 				free(convbuf);
 				convbuf = NULL;
 				if ((wcp = GETARG(wchar_t *)) == NULL) {
+					struct syslog_data sdata = SYSLOG_DATA_INIT;
+					int save_errno = errno;
+
+					syslog_r(LOG_CRIT | LOG_CONS, &sdata,
+					    "vfprintf \%ls NULL in \"%s\"", fmt0);
+					errno = save_errno;
+
 					cp = "(null)";
 				} else {
 					convbuf = __wcsconv(wcp, prec);
@@ -868,8 +876,16 @@ fp_common:
 				}
 			} else
 #endif /* PRINTF_WIDE_CHAR */
-			if ((cp = GETARG(char *)) == NULL)
+			if ((cp = GETARG(char *)) == NULL) {
+				struct syslog_data sdata = SYSLOG_DATA_INIT;
+				int save_errno = errno;
+
+				syslog_r(LOG_CRIT | LOG_CONS, &sdata,
+				    "vfprintf \%s NULL in \"%s\"", fmt0);
+				errno = save_errno;
+
 				cp = "(null)";
+			}
 			if (prec >= 0) {
 				/*
 				 * can't use strlen; can only look for the
diff --git a/lib/libc/stdio/vfwprintf.c b/lib/libc/stdio/vfwprintf.c
index 520c8bc7d22..e65dddc0c74 100644
--- a/lib/libc/stdio/vfwprintf.c
+++ b/lib/libc/stdio/vfwprintf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfwprintf.c,v 1.15 2015/12/28 22:08:18 mmcc Exp $ */
+/*	$OpenBSD: vfwprintf.c,v 1.16 2016/08/17 18:07:07 deraadt Exp $ */
 /*-
  * Copyright (c) 1990 The Regents of the University of California.
  * All rights reserved.
@@ -49,6 +49,7 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
+#include <syslog.h>
 #include <unistd.h>
 
 #include "local.h"
@@ -816,12 +817,28 @@ fp_common:
 			/*FALLTHROUGH*/
 		case 's':
 			if (flags & LONGINT) {
-				if ((cp = GETARG(wchar_t *)) == NULL)
+				if ((cp = GETARG(wchar_t *)) == NULL) {
+					struct syslog_data sdata = SYSLOG_DATA_INIT;
+					int save_errno = errno;
+
+					syslog_r(LOG_CRIT | LOG_CONS, &sdata,
+					    "vfwprintf \%ls NULL in \"%s\"", fmt0);
+					errno = save_errno;
+
 					cp = L"(null)";
+				}
 			} else {
 				char *mbsarg;
-				if ((mbsarg = GETARG(char *)) == NULL)
+				if ((mbsarg = GETARG(char *)) == NULL) {
+					struct syslog_data sdata = SYSLOG_DATA_INIT;
+					int save_errno = errno;
+
+					syslog_r(LOG_CRIT | LOG_CONS, &sdata,
+					    "vfwprintf \%s NULL in \"%s\"", fmt0);
+					errno = save_errno;
+
 					mbsarg = "(null)";
+				}
 				free(convbuf);
 				convbuf = __mbsconv(mbsarg, prec);
 				if (convbuf == NULL) {
-- 
2.20.1