Change in libosmocore[master]: logging/gsmtap: fix buffer overflow in _gsmtap_raw_output()

[Harald Welte]

Harald Welte has submitted this change and it was merged. ( https://gerrit.osmocom.org/12444 )

Change subject: logging/gsmtap: fix buffer overflow in _gsmtap_raw_output()
......................................................................

logging/gsmtap: fix buffer overflow in _gsmtap_raw_output()

According to the man page, vsnprintf() returns:

  - a negative value in case of error;
  - the number of characters written (excluding '\0');
  - the number of characters which *would have been written*
    if enough space had been available (excluding '\0').

We need to detect if the output was truncated, and properly
limit the amount of bytes to be reserved within a msgb.

Change-Id: Ifa822edf900ed925ba935c54a28c797c4657358a
---
M src/logging_gsmtap.c
1 file changed, 6 insertions(+), 0 deletions(-)

Approvals:
  Jenkins Builder: Verified
  Pau Espin Pedrol: Looks good to me, but someone else must approve
  Harald Welte: Looks good to me, approved



diff --git a/src/logging_gsmtap.c b/src/logging_gsmtap.c
index f17f292..98d2aad 100644
--- a/src/logging_gsmtap.c
+++ b/src/logging_gsmtap.c
@@ -102,6 +102,12 @@
 	if (rc < 0) {
 		msgb_free(msg);
 		return;
+	} else if (rc >= msgb_tailroom(msg)) {
+		/* If the output was truncated, vsnprintf() returns the
+		 * number of characters which would have been written
+		 * if enough space had been available (excluding '\0'). */
+		rc = msgb_tailroom(msg);
+		msg->tail[rc - 1]  = '\0';
 	}
 	msgb_put(msg, rc);
 

-- 
To view, visit https://gerrit.osmocom.org/12444
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: Ifa822edf900ed925ba935c54a28c797c4657358a
Gerrit-Change-Number: 12444
Gerrit-PatchSet: 1
Gerrit-Owner: Vadim Yanitskiy <axilirator at gmail.com>
Gerrit-Reviewer: Harald Welte <laforge at gnumonks.org>
Gerrit-Reviewer: Jenkins Builder (1000002)
Gerrit-Reviewer: Neels Hofmeyr <nhofmeyr at sysmocom.de>
Gerrit-Reviewer: Pau Espin Pedrol <pespin at sysmocom.de>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20181229/99389e18/attachment.htm>