From 620e6fe2d4ce8fcb5c31a90cfcb6bad0f409cec3 Mon Sep 17 00:00:00 2001 From: Olaf Bergmann Date: Mon, 24 Feb 2020 11:17:35 +0100 Subject: [PATCH] coap_debug.c: Use length returned by print_timestamp() In theory, print_timestamp() could omit the terminating null byte when the buffer passed as argument is too small or if snprintf() returns -1. To make coap_log_impl() more robust against unforeseen out-of-bounds access, the length returned by print_timestamp() now is passed to fprintf() explicitly. --- src/coap_debug.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/coap_debug.c b/src/coap_debug.c index 92937aca..8b7e898a 100644 --- a/src/coap_debug.c +++ b/src/coap_debug.c @@ -800,12 +800,14 @@ coap_log_impl(coap_log_t level, const char *format, ...) { coap_tick_t now; va_list ap; FILE *log_fd; + size_t len; log_fd = level <= LOG_CRIT ? COAP_ERR_FD : COAP_DEBUG_FD; coap_ticks(&now); - if (print_timestamp(timebuf,sizeof(timebuf), now)) - fprintf(log_fd, "%s ", timebuf); + len = print_timestamp(timebuf,sizeof(timebuf), now); + if (len) + fprintf(log_fd, "%.*s ", (int)len, timebuf); if (level <= COAP_LOG_CIPHERS) fprintf(log_fd, "%s ", loglevels[level]);