mirror of
https://github.com/pi-hole/FTL.git
synced 2026-08-25 06:22:28 +01:00
log: Drop empty FIFO records instead of indexing past the message buffer
`add_to_fifo_buffer()` looks for a trailing newline at `message[idx][copybytes - 1]`. With a zero `length` that index underflows to `message[idx][-1]`, so the record is read and possibly written out of bounds. A caller reaches this whenever `vsnprintf()` returns a negative value, since both `_FTL_log()` and `FTL_dnsmasq_log()` derive the length as `vsnprintf(...) + 1u`. Reject a NULL payload and a zero length before the slot is claimed, which also avoids consuming a ring buffer entry for a record we cannot store. Signed-off-by: DL6ER <dl6er@dl6er.de>
This commit is contained in:
@@ -732,6 +732,12 @@ void add_to_fifo_buffer(const enum fifo_logs which, const char *payload, const c
|
||||
if(!fifo_log)
|
||||
return;
|
||||
|
||||
// Nothing to store. A zero length would index message[idx][-1] when
|
||||
// looking for a trailing newline below, so drop the record entirely
|
||||
// rather than consuming a slot for it
|
||||
if(payload == NULL || length == 0)
|
||||
return;
|
||||
|
||||
unsigned int idx = fifo_log->logs[which].next_id++;
|
||||
if(idx >= LOG_SIZE)
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user