COVESA / COVESA/dlt-daemon

dlt_daemon_control_get_log_info_v2 never assigns req->apid / req->ctid; downstream lookups get NULL pointers

Open
#870 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
459
Forks
340
Avg merge
4d 21h
Merged PRs (30d)
2

Description

Function-specific follow-up to #866. Companion to PR #861 (which
addressed the OOB read in the same function but did not address the
parsing).

## Summary

`dlt_daemon_control_get_log_info_v2` in `src/daemon/dlt_daemon_client.c`
(around line 2098) does not actually parse the `apid` / `ctid` fields
out of incoming GET_LOG_INFO V2 requests. `req->apid` and `req->ctid`
remain NULL when passed to `dlt_daemon_application_find_v2` and
`dlt_daemon_context_find_v2`, so any request with a non-empty apid /
ctid is silently treated as a zero-length lookup.

## Evidence

The `DltServiceGetLogInfoRequestV2` struct
(`include/dlt/dlt_common.h:691-696`) declares `apid` and `ctid` as
`char *` pointers, not inline arrays.

In the function:

- Line ~2141: `req = calloc(1, sizeof(...));` — zero-initialises
`req`, so `req->apid` and `req->ctid` start NULL.
- Line ~2154:
`dlt_set_id_v2(req->apid, msg->databuffer + db_offset, req->apidlen);`
`dlt_set_id_v2` early-returns when its destination `id` is NULL
(`src/shared/dlt_common.c:417`), so this is a no-op. `req->apid`
remains NULL.
- Line ~2158: same for `req->ctid`.
- Line ~2186:
`dlt_daemon_application_find_v2(daemon, req->apidlen, req->apid, ...)`
called with `req->apid == NULL` despite `req->apidlen` being
non-zero.
- Line ~2199: same for `req->ctid` passed to
`dlt_daemon_context_find_v2`.

## Reproduction

Send a GET_LOG_INFO V2 request with a non-empty `apid` (e.g. 4 bytes
`"TEST"`) for a registered application. The daemon parses `apidlen`
correctly but never copies the `apid` bytes. The subsequent
`dlt_daemon_application_find_v2(daemon, 4, NULL, ...)` cannot match
the registered application — the response is built as if no
matching app exists.

## Proposed fix

Same shape as #864 for `set_log_level_v2`. When each length is
non-zero, point `req->apid` / `req->ctid` directly into
`msg->databuffer`:

```c
if (req->apidlen > 0) {
req->apid = (char *)(msg->databuffer + db_offset);
db_offset = db_offset + (int)req->apidlen;
}
```

Same for `req->ctid`. The message buffer outlives the function call,
so the pointer-into-databuffer trick is lifetime-safe.

I will extend PR #861 with this parse fix as a second commit rather
than open a new PR, since the two fixes touch the same lines and
sharing a PR avoids merge conflicts.

## Related

- #861 — partial fix (OOB read only) for the same function. Will
be extended to also close this issue.
- #863 — equivalent issue for `set_log_level_v2`.
- #866 — META-Issue covering the V2 control-handler family.

Contributor guide

No contributing guide indexed for this repository

Research direction

Read dlt_daemon_control_get_log_info_v2 in src/daemon/dlt_daemon_client.c, then inspect DltServiceGetLogInfoRequestV2 in include/dlt/dlt_common.h and dlt_set_id_v2 in src/shared/dlt_common.c. Reproduce a GET_LOG_INFO V2 request with non-empty apid or ctid and verify the downstream application or context lookup receives the parsed identifier and builds the matching response.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.