[Shrusti-pk]

sof-logger hands the log text from the .ldc file to fprintf() as the format string, and process_params() only logs when that text does not fit the params:

• more conversion specifiers than params_num: "Too many % conversion specifiers" is printed, then fprintf() runs with the full format anyway and each extra %s/%x reads a variadic argument that was never passed
• anything besides bare %s, %%, %pU and %pQ is forwarded as is, so "%5s" dereferences the 32-bit trace word as a char pointer (ASan SEGV on 0x41414141 in print_entry_params), and '*' and %n get through as well
• a crafted .ldc entry name %5s with params_num = 1, or val %u then %s with params_num = 1, run with sof-logger -l t.ldc -i t.trace -n reproduces both under ASan

process_params() now returns -EINVAL in those cases and the entry text is printed as a plain string. "%%" is skipped before the param count check. Output for %d %u %x %08x %zu %lx %llu %f %pU %pQ %s %% is unchanged.

[sofci]

Can one of the admins verify this patch?

reply test this please to run this test once

[intel-sofci]

PR 11331: test results

Run date: 2026-10-23 09:10 UTC

Tested commit: e301d06078a22abbf3e5a9eadb5149b1bbf73772

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

3 open issues

• spec_len parsing does not account for precision syntax (the .), so formats like %.*d / %.5s… · New
• The fallback here only forces params_num = 0, but it doesn’t ensure the original .ldc text is… · New
• This return contract is broader than the implementation: the function returns 0 even when it… · New

What changed in this PR

Updates sof-logger’s minimal printf-like formatting to reject unsafe/mismatched .ldc format strings (preventing out-of-bounds variadic reads and dangerous specifiers), and fall back to printing the entry text safely when validation fails.

Changes:

• Change process_params() to return a status code and reject invalid/unsafe format strings with -EINVAL.
• Skip "%%" before parameter-count validation and refuse unsupported/dangerous conversion patterns (e.g., *, %n, %s with modifiers).
• On validation failure, print the entry text without using it as a printf() format string.

File	Description
tools/​logger/​convert.c	Adds format-string validation and error propagation to prevent unsafe fprintf() usage with .ldc-provided format text.

_{Review effort: Lite}