Skip to content
Snippets Groups Projects
Commit 7359f448 authored by Beat Küng's avatar Beat Küng Committed by Lorenz Meier
Browse files

fix px4_log.c: avoid potential buffer overflow

The buffer length given to snprintf() is unsigned, so we must check for
an overflow after each call.

This happend for very long printf's (module documentation)
parent d90ac975
No related branches found
No related tags found
No related merge requests found
......@@ -106,22 +106,39 @@ __EXPORT void px4_log_modulename(int level, const char *moduleName, const char *
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", __px4_log_level_color[level]); }
if (pos >= max_length) { return; }
pos += snprintf(buffer + pos, max_length - pos, __px4__log_level_fmt __px4__log_level_arg(level));
if (pos >= max_length) { return; }
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", PX4_ANSI_COLOR_GRAY); }
if (pos >= max_length) { return; }
pos += snprintf(buffer + pos, max_length - pos, __px4__log_modulename_pfmt, moduleName);
va_list argptr;
if (pos >= max_length) { return; }
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", __px4_log_level_color[level]); }
if (pos >= max_length) { return; }
va_start(argptr, fmt);
pos += vsnprintf(buffer + pos, max_length - pos, fmt, argptr);
if (pos >= max_length) { return; }
va_end(argptr);
pos += snprintf(buffer + pos, max_length - pos, "\n");
if (pos >= max_length) { return; }
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", PX4_ANSI_COLOR_RESET); }
if (pos >= max_length) { return; }
// +1 for the terminating 0 char.
send_stdout_pipe_buffer(pos + 1);
}
......@@ -197,12 +214,18 @@ __EXPORT void px4_log_raw(int level, const char *fmt, ...)
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", __px4_log_level_color[level]); }
if (pos >= max_length) { return; }
va_start(argptr, fmt);
pos += vsnprintf(buffer + pos, max_length - pos, fmt, argptr);
va_end(argptr);
if (pos >= max_length) { return; }
if (is_atty) { pos += snprintf(buffer + pos, max_length - pos, "%s", PX4_ANSI_COLOR_RESET); }
if (pos >= max_length) { return; }
// +1 for the terminating 0 char.
send_stdout_pipe_buffer(pos + 1);
}
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment