Skip to content

fix potential mem corruption in utils_log_internal#1576

Open
bratpiorka wants to merge 1 commit into
oneapi-src:mainfrom
bratpiorka:rrudnick_log_fix
Open

fix potential mem corruption in utils_log_internal#1576
bratpiorka wants to merge 1 commit into
oneapi-src:mainfrom
bratpiorka:rrudnick_log_fix

Conversation

@bratpiorka
Copy link
Copy Markdown
Contributor

Fix potential mem corruption in utils_log_internal(), steps to reproduce:

tmp = snprintf(b_pos, b_size, "%s: ", func);
b_pos += (int)tmp;
b_size -= (int)tmp;

tmp = vsnprintf(b_pos, b_size, format, args);
b_pos += (int)tmp;
b_size -= (int)tmp;

The root cause is incorrect handling of the return values from snprintf() and vsnprintf(). These functions return the number of bytes that would have been written if enough space were available. The code unconditionally advances b_pos and reduces b_size by that return value, even when truncation occurred.

If the first snprintf() truncates, tmp can be larger than the remaining buffer. This moves b_pos past the end of the stack buffer and makes b_size invalid. The next vsnprintf() then writes through an invalid destination pointer, causing an out-of-bounds stack write.

@bratpiorka bratpiorka requested a review from a team as a code owner May 29, 2026 08:27
@bratpiorka bratpiorka force-pushed the rrudnick_log_fix branch 3 times, most recently from 15922c5 to 58042b1 Compare May 29, 2026 11:55
@lukaszstolarczuk lukaszstolarczuk requested a review from lplewa May 29, 2026 12:36
Comment thread src/utils/utils_log.c

b_pos += (int)tmp;
b_size -= (int)tmp;
log_buffer_advance(&b_pos, &b_size, tmp);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Define b_size as size_t to avoid further casting of size_t to int in log_buffer_append(). I think sizeof should already return size_t type number.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants