log: gracefully ignore failed log printing
What the developer wrote
Authored by Jon Griffiths
log: gracefully ignore failed log printing
What changed, and why it matters
This commit hardens three logging functions so they stop immediately if formatting a log message fails, instead of continuing with a negative or zero length. Previously, a failed format could cause the code to pass an invalid length to network or serial send functions. The change is defensive and reduces the chance of unexpected behavior from malformed log data, but it does not appear to fix an active security vulnerability.
Treat as a routine hardening commit. No urgent action is required, but ensure the change is included in the next firmware build and that logging format strings elsewhere are similarly validated.
Security signals we found
Defensive validation added to logging output paths
Negative length values no longer passed to socket/UART send functions
No explicit security framing in commit message or diff
Evidence from the diff
The patch modifies main/logging.c in the Blockstream Jade firmware. It makes the return value of write_log_line() const and adds checks for written <= 0 in serial_logger(), and written > 0 in wifi_socket_server_logger() and qemu_uart0_logger(). Previously, a negative return value from write_log_line() (for example, on a formatting error) would be passed directly to socket_server_send() or uart_write_bytes() as a length argument. The patch now short-circuits those calls. This is a robustness improvement that prevents passing invalid lengths to downstream send/write APIs.
Changed components
main/logging.cserial_logger()wifi_socket_server_logger()qemu_uart0_logger()Inspect captured patch +12 / −5
diff --git a/main/logging.c b/main/logging.c
index fd63763..85a45c0 100644
--- a/main/logging.c
+++ b/main/logging.c
@@ -32,7 +32,10 @@ static int write_log_line(char* buf, int buf_len, const char* message, va_list f
int serial_logger(const char* message, va_list fmt)
{
char buff[BUFFER_SIZE];
- int written = write_log_line(buff, sizeof(buff), message, fmt);
+ const int written = write_log_line(buff, sizeof(buff), message, fmt);
+ if (written <= 0) {
+ return written;
+ }
CborEncoder root_encoder;
uint8_t cbor_buff[BUFFER_SIZE + LOG_CBOR_OVERHEAD];
@@ -61,9 +64,11 @@ int serial_logger(const char* message, va_list fmt)
int wifi_socket_server_logger(const char* message, va_list fmt)
{
char buff[BUFFER_SIZE];
- int written = write_log_line(buff, sizeof(buff), message, fmt);
+ const int written = write_log_line(buff, sizeof(buff), message, fmt);
- socket_server_send(buff, written);
+ if (written > 0) {
+ socket_server_send(buff, written);
+ }
return written;
}
@@ -75,9 +80,11 @@ int wifi_socket_server_logger(const char* message, va_list fmt)
int qemu_uart0_logger(const char* message, va_list fmt)
{
char buff[BUFFER_SIZE];
- int written = write_log_line(buff, sizeof(buff), message, fmt);
+ const int written = write_log_line(buff, sizeof(buff), message, fmt);
- uart_write_bytes(UART_NUM_0, buff, written);
+ if (written > 0) {
+ uart_write_bytes(UART_NUM_0, buff, written);
+ }
return written;
}
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.