Skip to content

Commit 0d91e34

Browse files
committed
logger: fix off-by-one sscanf width in filter_parse_component_name
filter_parse_component_name() builds the sscanf format string with field width UUID_NAME_MAX_LEN, but a %N[...] conversion writes up to N characters plus a NUL terminator. comp_name is only UUID_NAME_MAX_LEN bytes, so a component name of exactly that length overflows the stack buffer by one byte. Cap the scan width at UUID_NAME_MAX_LEN - 1 so the terminator always fits in comp_name. Signed-off-by: jmestwa-coder <jmestwa@gmail.com>
1 parent 0f9fa75 commit 0d91e34

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

tools/logger/filter.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ static char *filter_parse_component_name(char *input_str, struct filter_element
104104
*/
105105
if (strlen(scan_format_string) == 0) {
106106
ret = snprintf(scan_format_string, sizeof(scan_format_string),
107-
"%%%d[^0-9* ]s", UUID_NAME_MAX_LEN);
107+
"%%%d[^0-9* ]s", UUID_NAME_MAX_LEN - 1);
108108
if (ret <= 0)
109109
return NULL;
110110
}

0 commit comments

Comments
 (0)