Skip to content

Commit

Permalink
Fix: illegal memory access in cmd_snapshot_list_outputs
Browse files Browse the repository at this point in the history
Found by Coverity:

CID 1243031 (#1 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)22. buffer_size_warning: Calling strncpy with a
maximum size argument of 4096 bytes on destination array (list +
idx).ctrl_url of size 4096 bytes might leave the destination string
unterminated.

CID 1243031 (#2 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)26. buffer_size_warning: Calling strncpy with a
maximum size argument of 255 bytes on destination array (list +
idx).name of size 255 bytes might leave the destination string
unterminated.

Signed-off-by: Mathieu Desnoyers <[email protected]>
Signed-off-by: Jérémie Galarneau <[email protected]>
  • Loading branch information
compudj authored and jgalar committed May 17, 2016
1 parent 0a85e7a commit 6ce2287
Showing 1 changed file with 11 additions and 3 deletions.
14 changes: 11 additions & 3 deletions src/bin/lttng-sessiond/cmd.c
Original file line number Diff line number Diff line change
Expand Up @@ -3356,10 +3356,18 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
assert(output->consumer);
list[idx].id = output->id;
list[idx].max_size = output->max_size;
strncpy(list[idx].name, output->name, sizeof(list[idx].name));
if (lttng_strncpy(list[idx].name, output->name,
sizeof(list[idx].name))) {
ret = -LTTNG_ERR_INVALID;
goto error;
}
if (output->consumer->type == CONSUMER_DST_LOCAL) {
strncpy(list[idx].ctrl_url, output->consumer->dst.trace_path,
sizeof(list[idx].ctrl_url));
if (lttng_strncpy(list[idx].ctrl_url,
output->consumer->dst.trace_path,
sizeof(list[idx].ctrl_url))) {
ret = -LTTNG_ERR_INVALID;
goto error;
}
} else {
/* Control URI. */
ret = uri_to_str_url(&output->consumer->dst.net.control,
Expand Down

0 comments on commit 6ce2287

Please sign in to comment.