[dpdk-dev] eal/log: fix memory corruption

[Olivier Matz]

From: Dongsu Han <dong...@cs.cmu.edu>

The '\0' is written outside the bounds of the log buffer, which can
result in memory corruption or display issues with log messages.

Use a new constant LOG_BUF_SIZE to store the effective size of the
buffer in struct log_history.

Signed-off-by: Dongsu Han <dongsuh at cs.cmu.edu>
Signed-off-by: Olivier Matz <olivier.matz at 6wind.com>
---
 lib/librte_eal/common/eal_common_log.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/librte_eal/common/eal_common_log.c 
b/lib/librte_eal/common/eal_common_log.c
index 1362109..9926ae4 100644
--- a/lib/librte_eal/common/eal_common_log.c
+++ b/lib/librte_eal/common/eal_common_log.c
@@ -64,6 +64,7 @@
 #include "eal_private.h"

 #define LOG_ELT_SIZE     2048
+#define LOG_BUF_SIZE     (LOG_ELT_SIZE - sizeof(struct log_history))

 #define LOG_HISTORY_MP_NAME "log_history"

@@ -196,7 +197,7 @@ rte_log_add_in_history(const char *buf, size_t size)
        }

        /* not enough room for msg, buffer go back in mempool */
-       if (size >= (LOG_ELT_SIZE - sizeof(*hist_buf))) {
+       if (size >= LOG_BUF_SIZE - 1) {
                rte_mempool_mp_put(log_history_mp, hist_buf);
                rte_spinlock_unlock(&log_list_lock);
                return -ENOBUFS;
@@ -204,7 +205,7 @@ rte_log_add_in_history(const char *buf, size_t size)

        /* add in history */
        memcpy(hist_buf->buf, buf, size);
-       hist_buf->buf[LOG_ELT_SIZE-1] = '\0';
+       hist_buf->buf[size] = '\0';
        hist_buf->size = size;
        STAILQ_INSERT_TAIL(&log_history, hist_buf, next);
        rte_spinlock_unlock(&log_list_lock);
-- 
1.7.10.4