From 94bc87febf5a6640fb8e96c5d49084f1cebb42ef Mon Sep 17 00:00:00 2001 From: Dongsu Han Date: Thu, 2 May 2013 09:22:37 +0000 Subject: [PATCH] log: fix history buffer overflow The '\0' is written outside the bounds of the log buffer, which can result in memory corruption or display issues with log messages. Use a new constant LOG_BUF_SIZE to store the effective size of the buffer in struct log_history. Signed-off-by: Dongsu Han Signed-off-by: Olivier Matz --- lib/librte_eal/common/eal_common_log.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/librte_eal/common/eal_common_log.c b/lib/librte_eal/common/eal_common_log.c index 53fa8bb471..b93311e4eb 100644 --- a/lib/librte_eal/common/eal_common_log.c +++ b/lib/librte_eal/common/eal_common_log.c @@ -63,6 +63,7 @@ #include "eal_private.h" #define LOG_ELT_SIZE 2048 +#define LOG_BUF_SIZE (LOG_ELT_SIZE - sizeof(struct log_history)) #define LOG_HISTORY_MP_NAME "log_history" @@ -195,7 +196,7 @@ rte_log_add_in_history(const char *buf, size_t size) } /* not enough room for msg, buffer go back in mempool */ - if (size >= (LOG_ELT_SIZE - sizeof(*hist_buf))) { + if (size >= LOG_BUF_SIZE - 1) { rte_mempool_mp_put(log_history_mp, hist_buf); rte_spinlock_unlock(&log_list_lock); return -ENOBUFS; @@ -203,7 +204,7 @@ rte_log_add_in_history(const char *buf, size_t size) /* add in history */ memcpy(hist_buf->buf, buf, size); - hist_buf->buf[LOG_ELT_SIZE-1] = '\0'; + hist_buf->buf[size] = '\0'; hist_buf->size = size; STAILQ_INSERT_TAIL(&log_history, hist_buf, next); rte_spinlock_unlock(&log_list_lock); -- 2.20.1