LogFilePrep: add a comment to the unsafe format string.

CVE-2018-14665 also made it possible to exploit this to access
memory. With -logfile forbidden when running with elevated privileges
this is no longer an issue.

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 248d164eae27f1f310266d78e52f13f64362f81e)

1 files changed, 2 insertions, 0 deletions

diff --git a/os/log.c b/os/log.c
index a3b28ccb4..803639ef0 100644
--- a/os/log.c
+++ b/os/log.c
@@ -194,6 +194,8 @@ LogFilePrep(const char *fname, const char *backup, const char *idstring)
 {
     char *logFileName = NULL;
 
+    /* the format string below is controlled by the user,
+       this code should never be called with elevated privileges */
     if (asprintf(&logFileName, fname, idstring) == -1)
         FatalError("Cannot allocate space for the log file name\n");