commit 3caa1ca92d98bf27019267296505c3ac0fdf6d72
author Peter Bigot <peter.bigot@nordicsemi.no> Sat Aug 17 23:02:10 2019 +0000
committer Anas Nashif <anas.nashif@intel.com> Tue Aug 20 19:21:03 2019 -0400
tree 6ddac44b28c4b6502972d855b801918b77d9ccd6
parent 61e084f102eca234bde74d966354263754971c3f

logging: avoid buffer overrun extracting arguments

The number of arguments for a format string is approximated by the
number of conversion specifications.  This count may exceed the maximum
supported argument count.  Limit the extraction to the available space.

Signed-off-by: Peter Bigot <peter.bigot@nordicsemi.no>

subsys/logging/log_core.c

diff --git a/subsys/logging/log_core.c b/subsys/logging/log_core.c
index 58fd8dd..b7289b5 100644
--- a/subsys/logging/log_core.c
+++ b/subsys/logging/log_core.c
@@ -246,6 +246,7 @@
 		u32_t args[LOG_MAX_NARGS];
 		u32_t nargs = count_args(fmt);
 
+		__ASSERT_NO_MSG(nargs < LOG_MAX_NARGS);
 		for (int i = 0; i < nargs; i++) {
 			args[i] = va_arg(ap, u32_t);
 		}