diff --git a/README.md b/README.md index 596a7ddb4..064652468 100755 --- a/README.md +++ b/README.md @@ -145,6 +145,7 @@ For previous versions, please read: ## V3 changes +* v3.0, 2019-12-11, For [#1229][bug #1229], fix the security risk in logger. 3.0.69 * v3.0, 2019-12-11, For [#1229][bug #1229], fix the security risk in HDS. 3.0.69 * v3.0, 2019-12-05, Fix [#1506][bug #1501], support directly turn FLV timestamp to TS DTS. 3.0.68 * v3.0, 2019-11-30, [3.0 alpha3(3.0.67)][r3.0a3] released. 110864 lines. diff --git a/trunk/src/app/srs_app_log.cpp b/trunk/src/app/srs_app_log.cpp index 9a54f5659..d5523dbda 100644 --- a/trunk/src/app/srs_app_log.cpp +++ b/trunk/src/app/srs_app_log.cpp @@ -192,7 +192,8 @@ void SrsFastLog::error(const char* tag, int context_id, const char* fmt, ...) va_end(ap); // add strerror() to error msg. - if (errno != 0) { + // Check size to avoid security issue https://github.com/ossrs/srs/issues/1229 + if (errno != 0 && size < LOG_MAX_SIZE) { size += snprintf(log_data + size, LOG_MAX_SIZE - size, "(%s)", strerror(errno)); } diff --git a/trunk/src/core/srs_core.hpp b/trunk/src/core/srs_core.hpp index 16ea216a1..71b3e7c98 100644 --- a/trunk/src/core/srs_core.hpp +++ b/trunk/src/core/srs_core.hpp @@ -27,7 +27,7 @@ // The version config. #define VERSION_MAJOR 3 #define VERSION_MINOR 0 -#define VERSION_REVISION 68 +#define VERSION_REVISION 69 // The macros generated by configure script. #include diff --git a/trunk/src/service/srs_service_log.cpp b/trunk/src/service/srs_service_log.cpp index d92cb5ce7..0ed454fd4 100644 --- a/trunk/src/service/srs_service_log.cpp +++ b/trunk/src/service/srs_service_log.cpp @@ -255,6 +255,12 @@ bool srs_log_header(char* buffer, int size, bool utc, bool dangerous, const char level, getpid(), cid); } } + + // Exceed the size, ignore this log. + // Check size to avoid security issue https://github.com/ossrs/srs/issues/1229 + if (written >= size) { + return false; + } if (written == -1) { return false; diff --git a/trunk/src/utest/srs_utest_core.cpp b/trunk/src/utest/srs_utest_core.cpp index 24da2ae9b..202ef3362 100644 --- a/trunk/src/utest/srs_utest_core.cpp +++ b/trunk/src/utest/srs_utest_core.cpp @@ -64,9 +64,33 @@ VOID TEST(CoreMacroseTest, Check) #endif } +#define _ARRAY_INIT(buf, sz, val) \ + for (int i = 0; i < (int)sz; i++) buf[i]=val + VOID TEST(CoreLogger, CheckVsnprintf) { - char buf[1024]; - EXPECT_EQ(6, sprintf(buf, "%s", "Hello!")); + if (true) { + char buf[1024]; + _ARRAY_INIT(buf, sizeof(buf), 0xf); + + // Return the number of characters printed. + EXPECT_EQ(6, sprintf(buf, "%s", "Hello!")); + EXPECT_EQ('H', buf[0]); + EXPECT_EQ('!', buf[5]); + EXPECT_EQ(0x0, buf[6]); + EXPECT_EQ(0xf, buf[7]); + } + + if (true) { + char buf[1024]; + _ARRAY_INIT(buf, sizeof(buf), 0xf); + + // Return the number of characters that would have been printed if the size were unlimited. + EXPECT_EQ(6, snprintf(buf, 3, "%s", "Hello!")); + EXPECT_EQ('H', buf[0]); + EXPECT_EQ('e', buf[1]); + EXPECT_EQ(0, buf[2]); + EXPECT_EQ(0xf, buf[3]); + } }