Thou shalt not overflow even stupidly small buffers

diff --git a/src/common/log.c b/src/common/log.c
index f58b05b1bf23662f8126187b99c8e13c93143f77..4b21fd9166d8b985a13aa25c2a590277622367f8 100644 (file)
--- a/src/common/log.c
+++ b/src/common/log.c
@@ -223,21 +223,31 @@ format_msg(char *buf, size_t buf_len,
   size_t n;
   int r;
   char *end_of_prefix;
+  char *buf_end;
 
   assert(buf_len >= 16); /* prevent integer underflow and general stupidity */
   buf_len -= 2; /* subtract 2 characters so we have room for \n\0 */
+  buf_end = buf+buf_len; /* point *after* the last char we can write to */
 
   n = _log_prefix(buf, buf_len, severity);
   end_of_prefix = buf+n;
 
   if (log_domains_are_logged) {
     char *cp = buf+n;
+    if (cp == buf_end) goto format_msg_no_room_for_domains;
     *cp++ = '{';
+    if (cp == buf_end) goto format_msg_no_room_for_domains;
     cp = domain_to_string(domain, cp, (buf+buf_len-cp));
+    if (cp == buf_end) goto format_msg_no_room_for_domains;
     *cp++ = '}';
+    if (cp == buf_end) goto format_msg_no_room_for_domains;
     *cp++ = ' ';
+    if (cp == buf_end) goto format_msg_no_room_for_domains;
     end_of_prefix = cp;
     n = cp-buf;
+  format_msg_no_room_for_domains:
+    /* This will leave end_of_prefix and n unchanged, and thus cause
+     * whatever log domain string we had written to be clobbered. */
   }
 
   if (funcname && should_log_function_name(domain, severity)) {