Fix out of bounds vector write in Logger::addOutput(ILogOutput *out)

est31 · est31 · commit 1f76808e4fa5 · 2015-10-25T00:13:01.000+02:00
Previously, the invocation of Logger::addOutput(ILogOutput *out) led to
an out of bounds write of the m_outputs vector, resulting in the
m_silenced_levels array being modified.

Fortunately, the only caller of that method was android system logging,
and only since a few commits ago.
diff --git a/src/log.cpp b/src/log.cpp
@@ -172,7 +172,7 @@ LogLevel Logger::stringToLevel(const std::string &name)
 
 void Logger::addOutput(ILogOutput *out)
 {
-	addOutputMaxLevel(out, LL_MAX);
+	addOutputMaxLevel(out, (LogLevel)(LL_MAX - 1));
 }
 
 void Logger::addOutput(ILogOutput *out, LogLevel lev)
@@ -182,6 +182,7 @@ void Logger::addOutput(ILogOutput *out, LogLevel lev)
 
 void Logger::addOutputMaxLevel(ILogOutput *out, LogLevel lev)
 {
+	assert(lev < LL_MAX);
 	for (size_t i = 0; i <= lev; i++)
 		m_outputs[i].push_back(out);
 }

Original file line number	Diff line number	Diff line change
`@@ -172,7 +172,7 @@ LogLevel Logger::stringToLevel(const std::string &name)`
`172`	`172`
`173`	`173`	`void Logger::addOutput(ILogOutput *out)`
`174`	`174`	`{`
`175`		`- addOutputMaxLevel(out, LL_MAX);`
	`175`	`+ addOutputMaxLevel(out, (LogLevel)(LL_MAX - 1));`
`176`	`176`	`}`
`177`	`177`
`178`	`178`	`void Logger::addOutput(ILogOutput *out, LogLevel lev)`
`@@ -182,6 +182,7 @@ void Logger::addOutput(ILogOutput *out, LogLevel lev)`
`182`	`182`
`183`	`183`	`void Logger::addOutputMaxLevel(ILogOutput *out, LogLevel lev)`
`184`	`184`	`{`
	`185`	`+ assert(lev < LL_MAX);`
`185`	`186`	`for (size_t i = 0; i <= lev; i++)`
`186`	`187`	`m_outputs[i].push_back(out);`
`187`	`188`	`}`