Summary
dlt_daemon_control_set_log_level_v2 in src/daemon/dlt_daemon_client.c
does not actually parse the apid / ctid fields out of incoming
SET_LOG_LEVEL V2 control requests. As a result:
- A request with
apidlen == 0 and ctidlen == 0 is silently no-op'd
(the function falls through to a path that calls
dlt_daemon_context_find_v2 with NULL apid/ctid).
- A request with
apidlen != 0 causes a NULL pointer dereference at
line ~3723 and crashes the daemon.
The function is reachable from any client that can talk to the daemon's
control socket (dispatched from dlt_daemon_handle_control_messages_v2
at line 1273 of the same file).
Evidence
The DltServiceSetLogLevelV2 struct
(include/dlt/dlt_common.h:760-769) declares apid and ctid as
pointers, not inline arrays:
Summary
dlt_daemon_control_set_log_level_v2insrc/daemon/dlt_daemon_client.cdoes not actually parse the
apid/ctidfields out of incomingSET_LOG_LEVEL V2 control requests. As a result:
apidlen == 0andctidlen == 0is silently no-op'd(the function falls through to a path that calls
dlt_daemon_context_find_v2with NULL apid/ctid).apidlen != 0causes a NULL pointer dereference atline ~3723 and crashes the daemon.
The function is reachable from any client that can talk to the daemon's
control socket (dispatched from
dlt_daemon_handle_control_messages_v2at line 1273 of the same file).
Evidence
The
DltServiceSetLogLevelV2struct(
include/dlt/dlt_common.h:760-769) declaresapidandctidaspointers, not inline arrays: