Skip to content

Commit

Permalink
Fix: illegal memory access in relayd_create_session_2_4
Browse files Browse the repository at this point in the history
Found by Coverity:
CID 1243024 (#1 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)2. buffer_size_warning: Calling strncpy with a
maximum size argument of 255 bytes on destination array msg.session_name
of size 255 bytes might leave the destination string unterminated.

CID 1243024 (#2 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)3. buffer_size_warning: Calling strncpy with a
maximum size argument of 64 bytes on destination array msg.hostname of
size 64 bytes might leave the destination string unterminated.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
compudj authored and jgalar committed May 17, 2016
1 parent bb5d54e commit 3a13ffd
Showing 1 changed file with 3 additions and 4 deletions.
7 changes: 3 additions & 4 deletions src/common/relayd/relayd.c
Original file line number Diff line number Diff line change
@@ -129,16 +129,15 @@ static int relayd_create_session_2_4(struct lttcomm_relayd_sock *rsock,
int ret;
struct lttcomm_relayd_create_session_2_4 msg;

if (strlen(session_name) >= sizeof(msg.session_name)) {
if (lttng_strncpy(msg.session_name, session_name,
sizeof(msg.session_name))) {
ret = -1;
goto error;
}
strncpy(msg.session_name, session_name, sizeof(msg.session_name));
if (strlen(hostname) >= sizeof(msg.hostname)) {
if (lttng_strncpy(msg.hostname, hostname, sizeof(msg.hostname))) {
ret = -1;
goto error;
}
strncpy(msg.hostname, hostname, sizeof(msg.hostname));
msg.live_timer = htobe32(session_live_timer);
msg.snapshot = htobe32(snapshot);

0 comments on commit 3a13ffd

Please sign in to comment.