[PATCH BlueZ v1] monitor: Fix crash due to negative max_len

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>

While calculating the max_len for printing the packet details that can
come out negative, so this discards extra text if that happens otherwise
it can cause the following error:

 Process terminating with default action of signal 6 (SIGABRT)
    at 0x4A800F4: __pthread_kill_implementation (in /usr/lib64/libc.so.6)
    by 0x4A26FDD: raise (in /usr/lib64/libc.so.6)
    by 0x4A0E941: abort (in /usr/lib64/libc.so.6)
    by 0x4A0F7A6: __libc_message_impl.cold (in /usr/lib64/libc.so.6)
    by 0x4B0E3B8: __fortify_fail (in /usr/lib64/libc.so.6)
    by 0x4B0DD53: __chk_fail (in /usr/lib64/libc.so.6)
    by 0x4B0F544: __snprintf_chk (in /usr/lib64/libc.so.6)
    by 0x11F3E6: snprintf (stdio2.h:68)
---
 monitor/packet.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/monitor/packet.c b/monitor/packet.c
index 2eb50896b55b..b186431cf135 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -490,6 +490,14 @@ static void print_packet(struct timeval *tv, struct ucred *cred, char ident,
 		int extra_len = extra ? strlen(extra) : 0;
 		int max_len = col - len - extra_len - ts_len - 3;
 
+		/* Check if there is enough space for the text and the label, if
+		 * there isn't then discard extra text since it won't fit.
+		 */
+		if (max_len <= 0) {
+			extra = NULL;
+			max_len = col - len - ts_len - 3;
+		}
+
 		n = snprintf(line + pos, max_len + 1, "%s%s",
 						label ? ": " : "", text);
 		if (n > max_len) {
-- 
2.48.1





[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux