Skip to content

[Bug]: 调用xqc_vsprintf时错用格式化字符导致崩溃 #500

@haojiubujian0

Description

@haojiubujian0

What happened?

在以下函数中,错误的格式化字符导致崩溃:(其他地方或许也有这个问题)

void
xqc_log_CON_CONNECTION_CLOSED_callback(xqc_log_t *log, const char *func, xqc_connection_t *conn)
{
    ...
    xqc_qlog_implement(log, CON_CONNECTION_CLOSED, func,
                            "|err_code:%d|mtu_updatad_count:%d|pkt_dropped:%d|recent_congestion:%s|", 
                            conn->conn_err, conn->MTU_updated_count, conn->packet_dropped_count, log_buf);
    ...
    xqc_qlog_implement(log, CON_CONNECTION_CLOSED, func,
                            "|err_code:%d|mtu_updatad_count:%d|pkt_dropped:%d|", 
                            conn->conn_err, conn->MTU_updated_count, conn->packet_dropped_count);
    }

其中,conn->conn_err类型为uint64_t,使用%d会导致va_arg计算指针偏移时发生错误,进而导致未定义行为;针对上述函数,在获取%s对应的参数时,得到NULL指针并最终崩溃。
解决:将上述conn_err对应的格式化字符从%d改为%uL

Steps To Reproduce

Relevant log output

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions