commit 305374cf0f8cf28b58a108cf4f45df92fc0dde86
author Mark Salyzyn <salyzyn@google.com> Thu Aug 18 14:59:41 2016 -0700
committer Mark Salyzyn <salyzyn@google.com> Tue Aug 23 14:51:50 2016 -0700
tree 4f7ae56a180ae568508f5da1f4f83e25a054d712
parent 82b67fff06363c8e7a17058cb5ce748f21a27f11

logger: validate hdr_size field in logger entry

- check hdr_size to make sure it is in the expected range
  from sizeof entry_v1 to entry (entry_v4).
- alter msg() method to report NULL on invalid hdr_size
- alter all users of msg() method.

Bug: 30947841
Change-Id: I9bc1740d7aa9f37df5be966c18de1fb9de63d5dd

liblog/logger_read.c

diff --git a/liblog/logger_read.c b/liblog/logger_read.c
index 00157b7..0d55453 100644
--- a/liblog/logger_read.c
+++ b/liblog/logger_read.c
@@ -367,6 +367,10 @@
     if (log_msg->entry_v2.hdr_size == 0) {
         log_msg->entry_v2.hdr_size = sizeof(struct logger_entry);
     }
+    if ((log_msg->entry_v2.hdr_size < sizeof(log_msg->entry_v1)) ||
+            (log_msg->entry_v2.hdr_size > sizeof(log_msg->entry))) {
+        return -EINVAL;
+    }
 
     /* len validation */
     if (ret <= log_msg->entry_v2.hdr_size) {