tree 4f2954216ae6b1363a094e54e75beab02e4a8de1
parent 794d2b5da87965440c531e53c54d74f412418f61
author Jack Pham <jackp@codeaurora.org> 1490892833 -0700
committer Jack Pham <jackp@codeaurora.org> 1491326364 -0700

trace: ipc_logging: Avoid buffer overflow in ipc_log_string()

In ipc_log_string() the return value from vsnprintf(), data_size,
is used to increment ectxt.offset. However, this length could
actually be much larger than that of ectxt.buff itself. This is a
typical mistake of [v]snprintf() usage [1], in that it returns
not the number of characters written but how many characters
*would* have been written regardless of whether it was truncated.
The result is that even though ectxt.buff itself is not overrun,
the incorrect size in ectxt.offset will be later used as the length
parameter when memcpy()'ing to the ipc_log_page's data, overflowing
that memory and beyond. The write_page's write_offset would also
indicate an out-of-bounds (greater than PAGE_SIZE) length.

The fix is simple: use vscnprintf() instead of vsnprintf().

[1] https://lwn.net/Articles/69419/

Change-Id: I2e9d44e74f5f30a009732e31a554d82e31946999
Signed-off-by: Jack Pham <jackp@codeaurora.org>