fly316/PX4-Autopilot
7
0
Fork 0
mirror of https://gitee.com/mirrors_PX4/PX4-Autopilot.git synced 2026-10-15 22:33:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix px4_log.c: avoid potential buffer overflow

Browse Source 
The buffer length given to snprintf() is unsigned, so we must check for
an overflow after each call.

This happend for very long printf's (module documentation)
This commit is contained in:
Beat Küng
2018-08-08 21:09:39 +02:00
committed by Lorenz Meier
parent d90ac975a7
commit 7359f44835
1 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/platforms/common/px4_log.c
+23
View File
@@ -106,22 +106,39 @@ __EXPORT void px4_log_modulename(int level, const char *moduleName, const char *
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", __px4_log_level_color[level]); }
if (pos >= max_length) { return; }
pos += snprintf(buffer + pos, max_length - pos, __px4__log_level_fmt __px4__log_level_arg(level));
if (pos >= max_length) { return; }
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", PX4_ANSI_COLOR_GRAY); }
if (pos >= max_length) { return; }
pos += snprintf(buffer + pos, max_length - pos, __px4__log_modulename_pfmt, moduleName);
va_list argptr;
if (pos >= max_length) { return; }
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", __px4_log_level_color[level]); }
if (pos >= max_length) { return; }
va_start(argptr, fmt);
pos += vsnprintf(buffer + pos, max_length - pos, fmt, argptr);
if (pos >= max_length) { return; }
va_end(argptr);
pos += snprintf(buffer + pos, max_length - pos, "\n");
if (pos >= max_length) { return; }
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", PX4_ANSI_COLOR_RESET); }
if (pos >= max_length) { return; }
// +1 for the terminating 0 char.
send_stdout_pipe_buffer(pos + 1);
}
@@ -197,12 +214,18 @@ __EXPORT void px4_log_raw(int level, const char *fmt, ...)
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", __px4_log_level_color[level]); }
if (pos >= max_length) { return; }
va_start(argptr, fmt);
pos += vsnprintf(buffer + pos, max_length - pos, fmt, argptr);
va_end(argptr);
if (pos >= max_length) { return; }
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", PX4_ANSI_COLOR_RESET); }
if (pos >= max_length) { return; }
// +1 for the terminating 0 char.
send_stdout_pipe_buffer(pos + 1);
}