Files
aria2/src/Logger.cc
Alexander Egorenkov 8718757e6c Logger: Fix format string overflow in writeHeader()
This problem occurred on a 32-bit ARM OpenWRT router running Linux 6.1.
The method writeHeader() assumes that the size of struct timeval is 8 bytes
which is not true on this machine, it is 16 bytes large. Therefore, first
cast tv.tv_usec to the unsigned long type.

=========
GDB trace
=========

 (gdb) c
 Continuing.

 Program received signal SIGSEGV, Segmentation fault.
 0xb6f4f9b4 in memchr (src=src@entry=0x3b6a, c=c@entry=0x0, n=n@entry=0x7fffffff) at src/string/memchr.c:16
 16              for (; ((uintptr_t)s & ALIGN) && n && *s != c; s++, n--);
    0xb6f4f98c <memchr+12>:      00 00 52 e3     cmp     r2, #0
    0xb6f4f990 <memchr+16>:      00 30 a0 e1     mov     r3, r0
    0xb6f4f994 <memchr+20>:      05 00 00 1a     bne     0xb6f4f9b0 <memchr+48>
    0xb6f4f998 <memchr+24>:      32 00 00 ea     b       0xb6f4fa68 <memchr+232>
    0xb6f4f99c <memchr+28>:      03 00 13 e3     tst     r3, #3
    0xb6f4f9a0 <memchr+32>:      01 20 42 e2     sub     r2, r2, #1
    0xb6f4f9a4 <memchr+36>:      36 00 00 0a     beq     0xb6f4fa84 <memchr+260>
    0xb6f4f9a8 <memchr+40>:      00 00 52 e3     cmp     r2, #0
    0xb6f4f9ac <memchr+44>:      2d 00 00 0a     beq     0xb6f4fa68 <memchr+232>
    0xb6f4f9b0 <memchr+48>:      03 00 a0 e1     mov     r0, r3
 => 0xb6f4f9b4 <memchr+52>:      01 c0 d3 e4     ldrb    r12, [r3], #1
    0xb6f4f9b8 <memchr+56>:      01 00 5c e1     cmp     r12, r1
    0xb6f4f9bc <memchr+60>:      f6 ff ff 1a     bne     0xb6f4f99c <memchr+28>
 (gdb) bt
 #0  0xb6f4f9b4 in memchr (src=src@entry=0x3b6a, c=c@entry=0x0, n=n@entry=0x7fffffff) at src/string/memchr.c:16
 #1  0xb6f512b4 in strnlen (s=s@entry=0x3b6a <error: Cannot access memory at address 0x3b6a>, n=n@entry=0x7fffffff) at src/string/strnlen.c:5
 #2  0xb6f19eb4 in printf_core (f=f@entry=0xb67d35b0, fmt=fmt@entry=0x101856 "%s.%06ld [%s] [%s:%d] ", ap=ap@entry=0xbe8f5a1c, nl_arg=nl_arg@entry=0xbe8f5a48, nl_type=<optimized out>, nl_type@entry=0xbe8f5a20) at
 src/stdio/vfprintf.c:599
 #3  0xb6f4b86c in vfprintf (f=0xb67d35b0, fmt=0x101856 "%s.%06ld [%s] [%s:%d] ", ap=...) at src/stdio/vfprintf.c:688
 #4  0x0001d92c in aria2::OutputFile::printf (this=<optimized out>, format=0x101856 "%s.%06ld [%s] [%s:%d] ") at OutputFile.h:58
 #5  0x00027910 in aria2::(anonymous namespace)::writeHeader<aria2::OutputFile> (lineNum=0xba, sourceFile=0x10d842 "HttpServer.cc", level=aria2::Logger::A2_INFO, fp=...) at Logger.cc:136
 #6  aria2::Logger::writeLog (this=0xb67cf78c, level=aria2::Logger::A2_INFO, sourceFile=0x10d842 "HttpServer.cc", lineNum=0xba, msg=0xb6766280 "HTTP Server received request\nPOST /jsonrpc HTTP/1.1\r\nHost: 192.168
 .1.1:6800\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/118.0\r\nAccept: application/json, text/plain, *"..., msg@entry=0x10d842 "HttpServer.cc", trace=trace@entry=0x124806 "") a
 t Logger.cc:196
 #7  0x00028bf0 in aria2::Logger::log (this=<optimized out>, level=<optimized out>, sourceFile=<optimized out>, lineNum=<optimized out>, msg=0xb6766280 "HTTP Server received request\nPOST /jsonrpc HTTP/1.1\r\nHost
 : 192.168.1.1:6800\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/118.0\r\nAccept: application/json, text/plain, *"...) at Logger.cc:213
 #8  0x00081708 in aria2::HttpServer::receiveRequest (this=0xb6774430) at /home/egorenar/Repositories/openwrt-rel/staging_dir/toolchain-arm_cortex-a15+neon-vfpv4_gcc-12.3.0_musl_eabi/arm-openwrt-linux-muslgnueabi/
 include/c++/12.3.0/bits/basic_string.h:233
 #9  aria2::HttpServerCommand::execute (this=0xb6772620) at HttpServerCommand.cc:194
 #10 0x00076de4 in aria2::(anonymous namespace)::executeCommand (commands=..., statusFilter=aria2::Command::STATUS_ALL) at DownloadEngine.cc:139
 #11 0x0001913c in aria2::DownloadEngine::run (oneshot=0x0, this=0xb67967e0) at DownloadEngine.cc:180
 #12 aria2::MultiUrlRequestInfo::execute (this=0xb67dee6c) at MultiUrlRequestInfo.cc:361
 #13 aria2::main (argv=<optimized out>, argc=<optimized out>) at main.cc:78
 #14 main (argc=<optimized out>, argv=<optimized out>) at main.cc:91

 (gdb) p tv
 $13 = {
   tv_sec = 0x652134fd,
   tv_usec = 0x3b6a
 }
 (gdb) call sizeof(tv)
 $14 = 0x10
 (gdb) call sizeof(tv.tv_usec)
 $15 = 0x8
 (gdb) call sizeof(long)
 $16 = 0x4
 (gdb) call sizeof(unsigned long)
 $17 = 0x4
 (gdb) call sizeof(time_t)
 $18 = 0x8

Signed-off-by: Alexander Egorenkov <egorenar-dev@posteo.net>
2023-10-07 14:29:01 +02:00

235 lines
6.3 KiB
C++

/* <!-- copyright */
/*
* aria2 - The high speed download utility
*
* Copyright (C) 2010 Tatsuhiro Tsujikawa
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
* You must obey the GNU General Public License in all respects
* for all of the code used other than OpenSSL. If you modify
* file(s) with this exception, you may extend this exception to your
* version of the file(s), but you are not obligated to do so. If you
* do not wish to do so, delete this exception statement from your
* version. If you delete this exception statement from all source
* files in the program, then also delete it here.
*/
/* copyright --> */
#include "Logger.h"
#include <unistd.h>
#include <cstring>
#include <cstdio>
#include <cassert>
#include "DlAbortEx.h"
#include "fmt.h"
#include "message.h"
#include "A2STR.h"
#include "a2time.h"
#include "BufferedFile.h"
#include "util.h"
#include "console.h"
namespace aria2 {
Logger::Logger()
: logLevel_(Logger::A2_DEBUG),
consoleLogLevel_(Logger::A2_NOTICE),
consoleOutput_(true),
colorOutput_(global::cout()->supportsColor())
{
}
Logger::~Logger() = default;
void Logger::openFile(const std::string& filename)
{
closeFile();
if (filename == DEV_STDOUT) {
fpp_ = global::cout();
}
else {
fpp_ =
std::make_shared<BufferedFile>(filename.c_str(), BufferedFile::APPEND);
if (!*static_cast<BufferedFile*>(fpp_.get())) {
throw DL_ABORT_EX(fmt(EX_FILE_OPEN, filename.c_str(), "n/a"));
}
}
}
void Logger::closeFile()
{
if (fpp_) {
fpp_.reset();
}
}
void Logger::setConsoleOutput(bool enabled) { consoleOutput_ = enabled; }
void Logger::setColorOutput(bool enabled) { colorOutput_ = enabled; }
bool Logger::fileLogEnabled(LEVEL level) { return level >= logLevel_ && fpp_; }
bool Logger::consoleLogEnabled(LEVEL level)
{
return consoleOutput_ && level >= consoleLogLevel_;
}
bool Logger::levelEnabled(LEVEL level)
{
return fileLogEnabled(level) || consoleLogEnabled(level);
}
namespace {
const char* levelToString(Logger::LEVEL level)
{
switch (level) {
case Logger::A2_DEBUG:
return "DEBUG";
case Logger::A2_INFO:
return "INFO";
case Logger::A2_NOTICE:
return "NOTICE";
case Logger::A2_WARN:
return "WARN";
case Logger::A2_ERROR:
return "ERROR";
default:
return "";
}
}
} // namespace
namespace {
template <typename Output>
void writeHeader(Output& fp, Logger::LEVEL level, const char* sourceFile,
int lineNum)
{
struct timeval tv;
gettimeofday(&tv, nullptr);
char datestr[20]; // 'YYYY-MM-DD hh:mm:ss'+'\0' = 20 bytes
struct tm tm;
// tv.tv_sec may not be of type time_t.
time_t timesec = tv.tv_sec;
localtime_r(&timesec, &tm);
size_t dateLength =
strftime(datestr, sizeof(datestr), "%Y-%m-%d %H:%M:%S", &tm);
assert(dateLength <= (size_t)20);
fp.printf("%s.%06ld [%s] [%s:%d] ", datestr, (unsigned long)tv.tv_usec,
levelToString(level), sourceFile, lineNum);
}
} // namespace
namespace {
const char* levelColor(Logger::LEVEL level)
{
switch (level) {
case Logger::A2_DEBUG:
return "\033[1;37m";
case Logger::A2_INFO:
return "\033[1;36m";
case Logger::A2_NOTICE:
return "\033[1;32m";
case Logger::A2_WARN:
return "\033[1;33m";
case Logger::A2_ERROR:
return "\033[1;31m";
default:
return "";
}
}
} // namespace
namespace {
template <typename Output>
void writeHeaderConsole(Output& fp, Logger::LEVEL level, bool useColor)
{
struct timeval tv;
gettimeofday(&tv, nullptr);
char datestr[15]; // 'MM/DD hh:mm:ss'+'\0' = 15 bytes
struct tm tm;
// tv.tv_sec may not be of type time_t.
time_t timesec = tv.tv_sec;
localtime_r(&timesec, &tm);
size_t dateLength = strftime(datestr, sizeof(datestr), "%m/%d %H:%M:%S", &tm);
assert(dateLength <= (size_t)15);
if (useColor) {
fp.printf("%s [%s%s\033[0m] ", datestr, levelColor(level),
levelToString(level));
}
else {
fp.printf("%s [%s] ", datestr, levelToString(level));
}
}
} // namespace
namespace {
template <typename Output>
void writeStackTrace(Output& fp, const char* stackTrace)
{
fp.write(stackTrace);
}
} // namespace
void Logger::writeLog(Logger::LEVEL level, const char* sourceFile, int lineNum,
const char* msg, const char* trace)
{
if (fileLogEnabled(level)) {
writeHeader(*fpp_, level, sourceFile, lineNum);
fpp_->printf("%s\n", msg);
writeStackTrace(*fpp_, trace);
fpp_->flush();
}
if (consoleLogEnabled(level)) {
global::cout()->printf("\n");
writeHeaderConsole(*global::cout(), level, colorOutput_);
global::cout()->printf("%s\n", msg);
writeStackTrace(*global::cout(), trace);
global::cout()->flush();
}
}
void Logger::log(LEVEL level, const char* sourceFile, int lineNum,
const char* msg)
{
writeLog(level, sourceFile, lineNum, msg, "");
}
void Logger::log(LEVEL level, const char* sourceFile, int lineNum,
const std::string& msg)
{
log(level, sourceFile, lineNum, msg.c_str());
}
void Logger::log(LEVEL level, const char* sourceFile, int lineNum,
const char* msg, const Exception& ex)
{
writeLog(level, sourceFile, lineNum, msg, ex.stackTrace().c_str());
}
void Logger::log(LEVEL level, const char* sourceFile, int lineNum,
const std::string& msg, const Exception& ex)
{
log(level, sourceFile, lineNum, msg.c_str(), ex);
}
} // namespace aria2