commit 29731732fdf4b0093bd776efeedb6aacf4107426
author Saman <samans@google.com> Tue May 05 02:05:41 2020 +0000
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Tue May 05 02:05:41 2020 +0000
tree 139c080a241817ead3e46e125248c578cae8f893
parent 8046219bb526178754eb2aa1a8669e71d663c9df

[logging] Fix possible overflow in syslog::SetTags

Bug: 40982
Change-Id: I574ce3cb445b3b595e0f3b865a7e68dea5a56d99
Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/385993
Commit-Queue: Saman Sami <samans@google.com>
Reviewed-by: Adam Barth <abarth@google.com>
Testability-Review: Adam Barth <abarth@google.com>

sdk/lib/syslog/cpp/logging_backend_fuchsia.cc

diff --git a/sdk/lib/syslog/cpp/logging_backend_fuchsia.cc b/sdk/lib/syslog/cpp/logging_backend_fuchsia.cc
index e1a1f690b..ad5ba05 100644
--- a/sdk/lib/syslog/cpp/logging_backend_fuchsia.cc
+++ b/sdk/lib/syslog/cpp/logging_backend_fuchsia.cc
@@ -26,9 +26,11 @@
 void SetLogSettings(const syslog::LogSettings& settings,
                     const std::initializer_list<std::string>& tags) {
   const char* ctags[FX_LOG_MAX_TAGS];
-  int i = 0;
+  size_t num_tags = 0;
   for (auto& tag : tags) {
-    ctags[i++] = tag.c_str();
+    ctags[num_tags++] = tag.c_str();
+    if (num_tags >= FX_LOG_MAX_TAGS)
+      break;
   }
   int fd = -1;
   if (!settings.log_file.empty()) {
@@ -41,7 +43,7 @@
                                .console_fd = fd,
                                .log_service_channel = ZX_HANDLE_INVALID,
                                .tags = ctags,
-                               .num_tags = tags.size()};
+                               .num_tags = num_tags};
   fx_log_reconfigure(&config);
 }
 

sdk/lib/syslog/cpp/logging_socket_unittest.cc

diff --git a/sdk/lib/syslog/cpp/logging_socket_unittest.cc b/sdk/lib/syslog/cpp/logging_socket_unittest.cc
index 5e9cc67..c450b3f1 100644
--- a/sdk/lib/syslog/cpp/logging_socket_unittest.cc
+++ b/sdk/lib/syslog/cpp/logging_socket_unittest.cc
@@ -199,5 +199,13 @@
   CheckSocketEmpty();
 }
 
+TEST_F(LoggingSocketTest, TooManyTags) {
+  constexpr const char* kLogMessage = "Hello";
+  syslog::SetTags({"1", "2", "3", "4", "5"});
+  FX_LOGS(ERROR) << kLogMessage;
+  ReadPacketAndCompare(FX_LOG_ERROR, kLogMessage, {"1", "2", "3", "4"});
+  CheckSocketEmpty();
+}
+
 }  // namespace
 }  // namespace syslog