Skip to content

dlt_daemon_control_set_log_level_v2 never assigns req.apid/req.ctid; silently fails or crashes the daemon #863

@SoundMatt

Description

@SoundMatt

Summary

dlt_daemon_control_set_log_level_v2 in src/daemon/dlt_daemon_client.c
does not actually parse the apid / ctid fields out of incoming
SET_LOG_LEVEL V2 control requests. As a result:

  • A request with apidlen == 0 and ctidlen == 0 is silently no-op'd
    (the function falls through to a path that calls
    dlt_daemon_context_find_v2 with NULL apid/ctid).
  • A request with apidlen != 0 causes a NULL pointer dereference at
    line ~3723 and crashes the daemon.

The function is reachable from any client that can talk to the daemon's
control socket (dispatched from dlt_daemon_handle_control_messages_v2
at line 1273 of the same file).

Evidence

The DltServiceSetLogLevelV2 struct
(include/dlt/dlt_common.h:760-769) declares apid and ctid as
pointers, not inline arrays:

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions