Skip to content

fix(log_router): stop buffer overrun#717

Open
Vincent-Dalstra wants to merge 1 commit into
espressif:masterfrom
Escape-This:master
Open

fix(log_router): stop buffer overrun#717
Vincent-Dalstra wants to merge 1 commit into
espressif:masterfrom
Escape-This:master

Conversation

@Vincent-Dalstra
Copy link
Copy Markdown
Contributor

@Vincent-Dalstra Vincent-Dalstra commented May 15, 2026

Description

The return value of vsnprintf() is used to determine how long the message was. However, when vsprintf() truncates a message this value will exceed the buffer! Then, vprintf_buffer[len] = '\0'; will cause undefined behaviour.

Add a check for truncation, which will then set the value of len to match the number of bytes in the buffer

Also removed the -1 from the 'size' argument to vsnprintf(), because it already accounts for the terminating '\0' byte.

Testing

I discovered this because my program would always crash after a particular log message. The stack trace showed that something was corrupting the g_esp_log_router_vprintf function pointer and cause any subsequent log messages to panic. Using the ESP32-S3 on-chip debugger I could put a watchpoint on g_esp_log_router_vprintfand thus detect when it was changed by vprintf_buffer[len] = '\0';

After fixing the problem, the program no longer crashes after that message, or other long messages.


Checklist

Before submitting a Pull Request, please ensure the following:

  • 🚨 This PR does not introduce breaking changes.
  • All CI checks (GH Actions) pass.
  • Documentation is updated as needed.
  • Tests are updated or added as necessary.
  • Code is well-commented, especially in complex areas.
  • Git history is clean — commits are squashed to the minimum necessary.

The return value of vsnprintf() is used to determine how long the
message was. However, when vsprintf() truncates a message this value
will exceed the buffer! Then, vprintf_buffer[len] = '\0'; will cause
undefined behaviour.

Add a check for truncation, which resets 'len' to the number of bytes in
the buffer.

Also removed the -1 from the 'size' argument to vsnprintf(), because it
already accounts for the terminating '\0' byte.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant