Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(log): fix out-of-bounds reads in binary log for buffer log apis

Browse Source 
- Fix MAX(len,2) reading beyond buffer when len=1
- Fix buffer_len=0 ambiguity with strlen fallback
- Add BUFFER_LEN_NOT_SET sentinel (-1)
- Read exactly len bytes, not forced minimum

Merges https://github.com/espressif/esp-idf/pull/18825
This commit is contained in:
yi chen
2026-07-21 16:47:50 +03:00
committed by Konstantin Kondrashov
parent f3db589cdc
commit 62e507ab8e
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/log/src/log_format_binary.c
+13 -5
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -59,6 +59,8 @@ typedef struct {
_Static_assert(sizeof(control_t) == 3, "control_t must be exactly 24 bits (3 bytes)");
#define BUFFER_LEN_NOT_SET (-1)
typedef struct {
uint8_t crc;
bool buffer_hex_log;
@@ -125,12 +127,17 @@ static unsigned output_pointer(const char *ptr, pkg_info_t *pkg_info)
if (PRESENT_IN_ELF(addr) || addr == 0) {
pkg_len = output(&addr, sizeof(addr), pkg_info);
} else {
int len = (pkg_info->buffer_len) ? pkg_info->buffer_len : strlen(ptr);
int16_t pkg_str_len = 1 - len;
int data_len = (pkg_info->buffer_len != BUFFER_LEN_NOT_SET) ? pkg_info->buffer_len : (int)strlen(ptr);
int encoded_len = MAX(data_len, 2);
int16_t pkg_str_len = 1 - encoded_len;
pkg_len = output(&pkg_str_len, sizeof(pkg_str_len), pkg_info);
for (unsigned i = 0; i < MAX(len, 2); i++) {
for (int i = 0; i < data_len; i++) {
pkg_len += output(&ptr[i], sizeof(uint8_t), pkg_info);
}
const uint8_t padding = 0;
for (int i = data_len; i < encoded_len; i++) {
pkg_len += output(&padding, sizeof(padding), pkg_info);
}
}
return pkg_len;
}
@@ -239,6 +246,7 @@ static unsigned calc_pkg_len(esp_log_msg_t *message, pkg_info_t *pkg_info)
pkg_len += output_arguments(message, args, pkg_info);
va_end(args);
pkg_len += sizeof(uint8_t); // crc8
pkg_info->buffer_len = BUFFER_LEN_NOT_SET;
pkg_info->len_calculation_stage = false;
return pkg_len;
}
@@ -269,7 +277,7 @@ void esp_log_format_binary(esp_log_msg_t *message)
.buffer_hex_log = message->format == __ESP_BUFFER_HEX_FORMAT__,
.buffer_char_log = message->format == __ESP_BUFFER_CHAR_FORMAT__,
.buffer_hexdump_log = message->format == __ESP_BUFFER_HEXDUMP_FORMAT__,
.buffer_len = 0,
.buffer_len = BUFFER_LEN_NOT_SET,
.len_calculation_stage = false,
};