From 2b1b1a3abde6fdf5ef1de129d31faa4dc7c4e109 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 7 Aug 2026 21:01:23 +0200 Subject: [PATCH] log: Drop empty FIFO records instead of indexing past the message buffer `add_to_fifo_buffer()` looks for a trailing newline at `message[idx][copybytes - 1]`. With a zero `length` that index underflows to `message[idx][-1]`, so the record is read and possibly written out of bounds. A caller reaches this whenever `vsnprintf()` returns a negative value, since both `_FTL_log()` and `FTL_dnsmasq_log()` derive the length as `vsnprintf(...) + 1u`. Reject a NULL payload and a zero length before the slot is claimed, which also avoids consuming a ring buffer entry for a record we cannot store. Signed-off-by: DL6ER --- src/log.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/log.c b/src/log.c index 79cd983e..43c6f895 100644 --- a/src/log.c +++ b/src/log.c @@ -732,6 +732,12 @@ void add_to_fifo_buffer(const enum fifo_logs which, const char *payload, const c if(!fifo_log) return; + // Nothing to store. A zero length would index message[idx][-1] when + // looking for a trailing newline below, so drop the record entirely + // rather than consuming a slot for it + if(payload == NULL || length == 0) + return; + unsigned int idx = fifo_log->logs[which].next_id++; if(idx >= LOG_SIZE) {