Skip to content

logger: convert: refuse ldc format text that does not match its params - #11331

Open
Shrusti-pk wants to merge 1 commit into
thesofproject:mainfrom
Shrusti-pk:logger-format-spec-check
Open

Shrusti-pk wants to merge 1 commit into
thesofproject:mainfrom
Shrusti-pk:logger-format-spec-check

Conversation

@Shrusti-pk

Copy link
Copy Markdown
Contributor

sof-logger hands the log text from the .ldc file to fprintf() as the format string, and process_params() only logs when that text does not fit the params:

  • more conversion specifiers than params_num: "Too many % conversion specifiers" is printed, then fprintf() runs with the full format anyway and each extra %s/%x reads a variadic argument that was never passed
  • anything besides bare %s, %%, %pU and %pQ is forwarded as is, so "%5s" dereferences the 32-bit trace word as a char pointer (ASan SEGV on 0x41414141 in print_entry_params), and '*' and %n get through as well
  • a crafted .ldc entry name %5s with params_num = 1, or val %u then %s with params_num = 1, run with sof-logger -l t.ldc -i t.trace -n reproduces both under ASan

process_params() now returns -EINVAL in those cases and the entry text is printed verbatim. "%%" is skipped before the param count check. Output for %d %u %x %08x %zu %lx %llu %f %pU %pQ %s %% is unchanged.

print_entry_params() hands the log text from the .ldc dictionary to
fprintf() as the format string, with params_num trace words as the
arguments. process_params() checks the text but only logs on a
mismatch: with more conversion specifiers than params_num it prints
"Too many % conversion specifiers" and fprintf() still runs with the
full format, so every extra %s or %x reads a variadic argument that
was never passed.

The generic branch also forwards any specifier other than bare %s,
%%, %pU and %pQ unchanged, so "%5s" or "%ls" dereferences the raw
32-bit trace word as a string pointer, a '*' width or precision
consumes an extra argument and %n writes through a trace value.

Return -EINVAL from process_params() for too many specifiers, a
trailing '%', and '*', 'n' or modified 's' conversions, and print the
entry text verbatim in that case. Skip "%%" before the parameter
count check since it does not consume a parameter. Output for valid
formats is unchanged.

Signed-off-by: Shrushti P K <shrusthi@labs.digiscrypt.com>
@sofci

sofci commented Oct 22, 2026

Copy link
Copy Markdown
Collaborator

Can one of the admins verify this patch?

reply test this please to run this test once

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants