From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from www.6wind.com (www.6wind.com [92.243.28.209]) by dpdk.org (Postfix) with ESMTP id 94038256 for ; Thu, 2 May 2013 11:23:27 +0200 (CEST) Received: from proxy.6wind.com (33.106-14-84.ripe.coltfrance.com [84.14.106.33]) by www.6wind.com (Postfix) with ESMTP id 427902E17C for ; Thu, 2 May 2013 11:22:35 +0200 (CEST) Received: from core.6wind.com (core.6wind.com [10.0.0.1]) by proxy.6wind.com (Postfix) with ESMTPS id 521E359812; Thu, 2 May 2013 10:47:20 +0200 (CEST) Received: from [10.16.0.195] (helo=6wind.com) by core.6wind.com with smtp (Exim 4.72) (envelope-from ) id 1UXpin-0001VY-S1; Thu, 02 May 2013 11:22:38 +0200 Received: by 6wind.com (sSMTP sendmail emulation); Thu, 02 May 2013 11:22:37 +0200 From: Olivier Matz To: dev@dpdk.org Date: Thu, 2 May 2013 11:22:37 +0200 Message-Id: <1367486557-8589-1-git-send-email-olivier.matz@6wind.com> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <51822F49.5040406@6wind.com> References: <51822F49.5040406@6wind.com> Cc: Dongsu Han Subject: [dpdk-dev] eal/log: fix memory corruption X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 May 2013 09:23:27 -0000 From: Dongsu Han The '\0' is written outside the bounds of the log buffer, which can result in memory corruption or display issues with log messages. Use a new constant LOG_BUF_SIZE to store the effective size of the buffer in struct log_history. Signed-off-by: Dongsu Han Signed-off-by: Olivier Matz --- lib/librte_eal/common/eal_common_log.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/librte_eal/common/eal_common_log.c b/lib/librte_eal/common/eal_common_log.c index 1362109..9926ae4 100644 --- a/lib/librte_eal/common/eal_common_log.c +++ b/lib/librte_eal/common/eal_common_log.c @@ -64,6 +64,7 @@ #include "eal_private.h" #define LOG_ELT_SIZE 2048 +#define LOG_BUF_SIZE (LOG_ELT_SIZE - sizeof(struct log_history)) #define LOG_HISTORY_MP_NAME "log_history" @@ -196,7 +197,7 @@ rte_log_add_in_history(const char *buf, size_t size) } /* not enough room for msg, buffer go back in mempool */ - if (size >= (LOG_ELT_SIZE - sizeof(*hist_buf))) { + if (size >= LOG_BUF_SIZE - 1) { rte_mempool_mp_put(log_history_mp, hist_buf); rte_spinlock_unlock(&log_list_lock); return -ENOBUFS; @@ -204,7 +205,7 @@ rte_log_add_in_history(const char *buf, size_t size) /* add in history */ memcpy(hist_buf->buf, buf, size); - hist_buf->buf[LOG_ELT_SIZE-1] = '\0'; + hist_buf->buf[size] = '\0'; hist_buf->size = size; STAILQ_INSERT_TAIL(&log_history, hist_buf, next); rte_spinlock_unlock(&log_list_lock); -- 1.7.10.4