d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

log: fix history buffer overflow

Browse Source 
The '\0' is written outside the bounds of the log buffer, which can
result in memory corruption or display issues with log messages.

Use a new constant LOG_BUF_SIZE to store the effective size of the
buffer in struct log_history.

Signed-off-by: Dongsu Han <dongsuh@cs.cmu.edu>
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
This commit is contained in:
Dongsu Han 2013-05-02 09:22:37 +00:00 committed by Thomas Monjalon
parent 30a37273c1
commit 94bc87febf
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/librte_eal/common/eal_common_log.c
View File

@ -63,6 +63,7 @@
#include "eal_private.h"
#define LOG_ELT_SIZE 2048
#define LOG_BUF_SIZE (LOG_ELT_SIZE - sizeof(struct log_history))
#define LOG_HISTORY_MP_NAME "log_history"
@ -195,7 +196,7 @@ rte_log_add_in_history(const char *buf, size_t size)
}
/* not enough room for msg, buffer go back in mempool */
if (size >= (LOG_ELT_SIZE - sizeof(*hist_buf))) {
if (size >= LOG_BUF_SIZE - 1) {
rte_mempool_mp_put(log_history_mp, hist_buf);
rte_spinlock_unlock(&log_list_lock);
return -ENOBUFS;
@ -203,7 +204,7 @@ rte_log_add_in_history(const char *buf, size_t size)
/* add in history */
memcpy(hist_buf->buf, buf, size);
hist_buf->buf[LOG_ELT_SIZE-1] = '\0';
hist_buf->buf[size] = '\0';
hist_buf->size = size;
STAILQ_INSERT_TAIL(&log_history, hist_buf, next);
rte_spinlock_unlock(&log_list_lock);