Skip to content

Commit 808c02b

Browse files
committed
daemon: parse apid/ctid in dlt_daemon_control_get_log_info_v2
Companion fix to the OOB-read fix in this same commit series. The function never assigned req->apid or req->ctid: req is calloc'd, so the char * pointer fields start NULL, and the dlt_set_id_v2(req->apid, ...) call to populate them was a no-op (dlt_set_id_v2 early-returns when its destination is NULL). req->apid / req->ctid stayed NULL and were then passed to dlt_daemon_application_find_v2 and dlt_daemon_context_find_v2 despite req->apidlen / req->ctidlen being non-zero — every non-empty lookup was silently turned into a zero-length one. Replace the no-op dlt_set_id_v2 calls with conditional pointer assignments into msg->databuffer, mirroring the surgical approach taken for set_log_level_v2 in PR COVESA#864 and unregister_context_v2 in PR COVESA#868. The bounds checks added in the previous commit ensure the pointer-into-databuffer assignments are safe. Closes COVESA#870. Related: COVESA#866.
1 parent cc31ed3 commit 808c02b

1 file changed

Lines changed: 15 additions & 4 deletions

File tree

src/daemon/dlt_daemon_client.c

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2163,8 +2163,17 @@ void dlt_daemon_control_get_log_info_v2(int sock,
21632163
return;
21642164
}
21652165

2166-
dlt_set_id_v2(req->apid, (const char *)(msg->databuffer + db_offset), req->apidlen);
2167-
db_offset = db_offset + (int)req->apidlen;
2166+
/* Point req->apid into msg->databuffer when apidlen > 0; leave NULL
2167+
* otherwise. The previous dlt_set_id_v2(req->apid, ...) call here was
2168+
* a no-op because req->apid is a calloc'd char * pointer (NULL).
2169+
* Without this, req->apid stays NULL and is later passed to
2170+
* dlt_daemon_application_find_v2() despite req->apidlen being non-zero,
2171+
* silently turning every non-empty apid lookup into a zero-length one.
2172+
* See #870 for full analysis. */
2173+
if (req->apidlen > 0) {
2174+
req->apid = (char *)(msg->databuffer + db_offset);
2175+
db_offset = db_offset + (int)req->apidlen;
2176+
}
21682177
memcpy(&(req->ctidlen), (const char *)(msg->databuffer + db_offset), sizeof(uint8_t));
21692178
db_offset = db_offset + (int)sizeof(uint8_t);
21702179

@@ -2175,8 +2184,10 @@ void dlt_daemon_control_get_log_info_v2(int sock,
21752184
return;
21762185
}
21772186

2178-
dlt_set_id_v2(req->ctid, (const char *)(msg->databuffer + db_offset), req->ctidlen);
2179-
db_offset = db_offset + (int)req->ctidlen;
2187+
if (req->ctidlen > 0) {
2188+
req->ctid = (char *)(msg->databuffer + db_offset);
2189+
db_offset = db_offset + (int)req->ctidlen;
2190+
}
21802191
memcpy((req->com), (const char *)(msg->databuffer + db_offset), DLT_ID_SIZE);
21812192

21822193
/* initialise new message */

0 commit comments

Comments
 (0)