tequilaOS/platform_bionic
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix stack use-after-scope in async_safe_log.

Browse source 
The buffer filled in by strerror_r needs to stay in scope while
it is pointed to by str.

Bug: 273807460
Change-Id: I494ca8b8aca2b28ec2f0f3da72d845db99633553
This commit is contained in:
Peter Collingbourne 2023-03-15 15:20:57 -07:00
parent d2e55dd05b
commit 84979776d0
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
libc/async_safe/async_safe_log.cpp
View file

@ -345,6 +345,7 @@ static void out_vformat(Out& o, const char* format, va_list args) {
/* conversion specifier */
const char* str = buffer;
char strerror_buf[256];
if (c == 's') {
/* string */
str = va_arg(args, const char*);
@ -359,8 +360,7 @@ static void out_vformat(Out& o, const char* format, va_list args) {
buffer[1] = 'x';
format_integer(buffer + 2, sizeof(buffer) - 2, value, 'x');
} else if (c == 'm') {
char buf[256];
str = strerror_r(errno, buf, sizeof(buf));
str = strerror_r(errno, strerror_buf, sizeof(strerror_buf));
} else if (c == 'd' || c == 'i' || c == 'o' || c == 'u' || c == 'x' || c == 'X') {
/* integers - first read value from stack */
uint64_t value;