dlt_daemon_control_get_log_info_v2 never assigns req->apid / req->ctid; downstream lookups get NULL pointers
- Dominant language
- C
- Stars
- 459
- Forks
- 340
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 2
Description
Function-specific follow-up to #866. Companion to PR #861 (which
addressed the OOB read in the same function but did not address the
parsing).
## Summary
`dlt_daemon_control_get_log_info_v2` in `src/daemon/dlt_daemon_client.c`
(around line 2098) does not actually parse the `apid` / `ctid` fields
out of incoming GET_LOG_INFO V2 requests. `req->apid` and `req->ctid`
remain NULL when passed to `dlt_daemon_application_find_v2` and
`dlt_daemon_context_find_v2`, so any request with a non-empty apid /
ctid is silently treated as a zero-length lookup.
## Evidence
The `DltServiceGetLogInfoRequestV2` struct
(`include/dlt/dlt_common.h:691-696`) declares `apid` and `ctid` as
`char *` pointers, not inline arrays.
In the function:
- Line ~2141: `req = calloc(1, sizeof(...));` — zero-initialises
`req`, so `req->apid` and `req->ctid` start NULL.
- Line ~2154:
`dlt_set_id_v2(req->apid, msg->databuffer + db_offset, req->apidlen);`
`dlt_set_id_v2` early-returns when its destination `id` is NULL
(`src/shared/dlt_common.c:417`), so this is a no-op. `req->apid`
remains NULL.
- Line ~2158: same for `req->ctid`.
- Line ~2186:
`dlt_daemon_application_find_v2(daemon, req->apidlen, req->apid, ...)`
called with `req->apid == NULL` despite `req->apidlen` being
non-zero.
- Line ~2199: same for `req->ctid` passed to
`dlt_daemon_context_find_v2`.
## Reproduction
Send a GET_LOG_INFO V2 request with a non-empty `apid` (e.g. 4 bytes
`"TEST"`) for a registered application. The daemon parses `apidlen`
correctly but never copies the `apid` bytes. The subsequent
`dlt_daemon_application_find_v2(daemon, 4, NULL, ...)` cannot match
the registered application — the response is built as if no
matching app exists.
## Proposed fix
Same shape as #864 for `set_log_level_v2`. When each length is
non-zero, point `req->apid` / `req->ctid` directly into
`msg->databuffer`:
```c
if (req->apidlen > 0) {
req->apid = (char *)(msg->databuffer + db_offset);
db_offset = db_offset + (int)req->apidlen;
}
```
Same for `req->ctid`. The message buffer outlives the function call,
so the pointer-into-databuffer trick is lifetime-safe.
I will extend PR #861 with this parse fix as a second commit rather
than open a new PR, since the two fixes touch the same lines and
sharing a PR avoids merge conflicts.
## Related
- #861 — partial fix (OOB read only) for the same function. Will
be extended to also close this issue.
- #863 — equivalent issue for `set_log_level_v2`.
- #866 — META-Issue covering the V2 control-handler family.
Contributor guide
No contributing guide indexed for this repository
Research direction
Read dlt_daemon_control_get_log_info_v2 in src/daemon/dlt_daemon_client.c, then inspect DltServiceGetLogInfoRequestV2 in include/dlt/dlt_common.h and dlt_set_id_v2 in src/shared/dlt_common.c. Reproduce a GET_LOG_INFO V2 request with non-empty apid or ctid and verify the downstream application or context lookup receives the parsed identifier and builds the matching response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 30/100