{"id":351,"date":"2006-12-19T04:28:00","date_gmt":"2006-12-19T04:28:00","guid":{"rendered":"https:\/\/defragged.org\/ossec\/?p=351"},"modified":"2020-07-03T04:29:06","modified_gmt":"2020-07-03T04:29:06","slug":"stdarg-misuse-c-tip-1","status":"publish","type":"post","link":"https:\/\/defragged.org\/ossec\/2006\/12\/stdarg-misuse-c-tip-1\/","title":{"rendered":"stdarg misuse (C tip #1)"},"content":{"rendered":"\n<p>I received some reports in the past about&nbsp;<a href=\"http:\/\/www.ossec.net\/\">OSSEC<\/a>&nbsp;segfaulting during startup on 64 bits systems. However, I was never able to reproduce this problem until last week.. I was happily enjoying my \u201cvacation\u201d and playing with ossec on an&nbsp;<a href=\"http:\/\/www.ubuntu.com\/\">Ubuntu<\/a>&nbsp;64 when I finally got the ugly&nbsp;<em>\u201c2006\/12\/16 15:26:21 Segmentation fault\u201d<\/em>&nbsp;during startup. A smile came in my face\u2026 I would be able to debug it now \ud83d\ude42 . After some troubleshooting I finally noticed that I was misusing the&nbsp;<a href=\"http:\/\/www.openbsd.org\/cgi-bin\/man.cgi?query=va_start\">stdarg<\/a>&nbsp;functions. I was never able to reproduce this issue before, because it only happens when there is a configuration problem and ossec tries to print the error message to the log file and to stderr (by default it only writes to the log file).<\/p>\n\n\n\n<p>Basically, what was happening is that I was calling va_start, followed by multiple vfprintf calls. I don\u2019t know exactly why it works on 32 bits systems and not on 64 bits (it should fail everywhere), but the easiest solution was to duplicate the va_list using va_copy. So, just for the record, never do:<\/p>\n\n\n\n<p><em>va_start(args, msg);<br>vfprintf(stderr, msg, args);<br>vfprintf(fp, msg, args);<br>va_end(args);<\/em><\/p>\n\n\n\n<p>If you need to print a formatted string multiple times, just do a vsnprintf, followed by fprintf\u2019s or use va_copy to duplicate the va_list:<\/p>\n\n\n\n<p><em>va_start(args, msg);<br>va_copy(args2, args);<br>vfprintf(stderr, msg, args);<br>vfprintf(fp, msg, args);<br>va_end(args);<\/em><\/p>\n\n\n\n<p>It may sound like an obvious advice, but it may be useful to someone\u2026<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I received some reports in the past about&nbsp;OSSEC&nbsp;segfaulting during startup on 64 bits systems. However, I was never able to reproduce this problem until last week.. I was happily enjoying my \u201cvacation\u201d and playing with ossec on an&nbsp;Ubuntu&nbsp;64 when I finally got the ugly&nbsp;\u201c2006\/12\/16 15:26:21 Segmentation fault\u201d&nbsp;during startup. A smile came in my face\u2026 I [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/351"}],"collection":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/comments?post=351"}],"version-history":[{"count":1,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/351\/revisions"}],"predecessor-version":[{"id":352,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/351\/revisions\/352"}],"wp:attachment":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/media?parent=351"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/categories?post=351"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/tags?post=351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}