unsafe use of syslog(3)

if ((pwd=getpwuid(port_user(port))) == NULL)
        username="(none)";
else
        username=pwd->pw_name;
iov[1].iov_len=snprintf(msg,sizeof(msg),"ipv%d %s mac=%02x:%02x:%02x:%02x:%02x:%02x port=%d vlan=%d user=%s",
                (len==4)?4:6, hostname,
                srcmac[0], srcmac[1], srcmac[2], srcmac[3], srcmac[4], srcmac[5],
                port, vlan, username);
for (epn=0; (descr=port_descr(port,epn)) != NULL; epn++) {
        int len=iov[1].iov_len;
        int descrlen=snprintf(msg+len,sizeof(msg)-len," \"%s\"",descr);
        iov[1].iov_len+=descrlen;
}
if (logfilefd >= 0) {
        time_t ntime=time(&ntime);
        ctime_r(&ntime,stime);
        writev(logfilefd,iov,3);
} else if (logfilefd != -1)
        syslog(LOG_INFO, msg);

If the hostname or the username contains format string specifiers, such as %n, this may be a format string vulnerability.

The fix should be simple, replace the final line with:

syslog(LOG_INFO, "%s", msg);