log: Drop empty FIFO records instead of indexing past the message buffer

`add_to_fifo_buffer()` looks for a trailing newline at
`message[idx][copybytes - 1]`. With a zero `length` that index underflows
to `message[idx][-1]`, so the record is read and possibly written out of
bounds. A caller reaches this whenever `vsnprintf()` returns a negative
value, since both `_FTL_log()` and `FTL_dnsmasq_log()` derive the length
as `vsnprintf(...) + 1u`.

Reject a NULL payload and a zero length before the slot is claimed, which
also avoids consuming a ring buffer entry for a record we cannot store.

Signed-off-by: DL6ER <dl6er@dl6er.de>
This commit is contained in:
DL6ER
2026-08-07 21:01:23 +02:00
parent cce7047bfa
commit 2b1b1a3abd
+6
View File
@@ -732,6 +732,12 @@ void add_to_fifo_buffer(const enum fifo_logs which, const char *payload, const c
if(!fifo_log)
return;
// Nothing to store. A zero length would index message[idx][-1] when
// looking for a trailing newline below, so drop the record entirely
// rather than consuming a slot for it
if(payload == NULL || length == 0)
return;
unsigned int idx = fifo_log->logs[which].next_id++;
if(idx >= LOG_SIZE)
{