Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b45b5c9f authored by Keith Preston's avatar Keith Preston Committed by preston
Browse files

Fix Heap Corruption from too long of a TAG 

snprintf has a weird return value.   It returns what would have been written given a large enough buffer.
In the case that the prefix is longer then our buffer(128), it messes up the calculations below possibly causing heap corruption.
To avoid this we double check and set the length at the maximum (size minus null byte
parent 91a54c11

liblog/logprint.c

+10 −0
Original line number Diff line number Diff line
@@ -753,6 +753,16 @@ char *android_log_formatLogLine ( 
            suffixLen = 1;

            break;

    }

    /* snprintf has a weird return value.   It returns what would have been

     * written given a large enough buffer.  In the case that the prefix is

     * longer then our buffer(128), it messes up the calculations below

     * possibly causing heap corruption.  To avoid this we double check and

     * set the length at the maximum (size minus null byte)

     */

    if(prefixLen >= sizeof(prefixBuf))

        prefixLen = sizeof(prefixBuf) - 1;

    if(suffixLen >= sizeof(suffixBuf))

        suffixLen = sizeof(suffixBuf) - 1;



    /* the following code is tragically unreadable */