Fix: illegal memory access in list_events

Found by Coverity: CID 1243022 (#1 of 1): Buffer not null terminated (BUFFER_SIZE_WARNING)23. buffer_size_warning: Calling strncpy with a maximum size argument of 256 bytes on destination array (tmp_events + i).name of size 256 bytes might leave the destination string unterminated. Signed-off-by: Mathieu Desnoyers <[email protected]> Signed-off-by: Jérémie Galarneau <[email protected]>
lttng · May 17, 2016 · 0a85e7a · 0a85e7a
1 parent 63be730
commit 0a85e7a
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/src/bin/lttng-sessiond/agent.c b/src/bin/lttng-sessiond/agent.c
@@ -353,8 +353,11 @@ static ssize_t list_events(struct agent_app *app, struct lttng_event **events)
 
 	for (i = 0; i < nb_event; i++) {
 		offset += len;
-		strncpy(tmp_events[i].name, reply->payload + offset,
-				sizeof(tmp_events[i].name));
+		if (lttng_strncpy(tmp_events[i].name, reply->payload + offset,
+				sizeof(tmp_events[i].name))) {
+			ret = LTTNG_ERR_INVALID;
+			goto error;
+		}
 		tmp_events[i].pid = app->pid;
 		tmp_events[i].enabled = -1;
 		len = strlen(reply->payload + offset) + 1;