Skip to content

Commit

Permalink
Fix: illegal memory access in session_create
Browse files Browse the repository at this point in the history
Found by Coverity:

CID 1323138 (#1 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)3. buffer_size_warning: Calling strncpy with a
maximum size argument of 64 bytes on destination array session->hostname
of size 64 bytes might leave the destination string unterminated.

CID 1323138 (#2 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)3. buffer_size_warning: Calling strncpy with a
maximum size argument of 255 bytes on destination array
session->session_name of size 255 bytes might leave the destination
string unterminated.

Signed-off-by: Mathieu Desnoyers <[email protected]>
Signed-off-by: Jérémie Galarneau <[email protected]>
  • Loading branch information
compudj authored and jgalar committed May 17, 2016
1 parent 2edf492 commit bb5d54e
Showing 1 changed file with 11 additions and 8 deletions.
19 changes: 11 additions & 8 deletions src/bin/lttng-relayd/session.c
Original file line number Diff line number Diff line change
Expand Up @@ -46,11 +46,16 @@ struct relay_session *session_create(const char *session_name,
PERROR("relay session zmalloc");
goto error;
}

if (lttng_strncpy(session->session_name, session_name,
sizeof(session->session_name))) {
goto error;
}
if (lttng_strncpy(session->hostname, hostname,
sizeof(session->hostname))) {
goto error;
}
session->ctf_traces_ht = lttng_ht_new(0, LTTNG_HT_TYPE_STRING);
if (!session->ctf_traces_ht) {
free(session);
session = NULL;
goto error;
}

Expand All @@ -67,17 +72,15 @@ struct relay_session *session_create(const char *session_name,
pthread_mutex_init(&session->reflock, NULL);
pthread_mutex_init(&session->recv_list_lock, NULL);

strncpy(session->session_name, session_name,
sizeof(session->session_name));
strncpy(session->hostname, hostname,
sizeof(session->hostname));
session->live_timer = live_timer;
session->snapshot = snapshot;

lttng_ht_add_unique_u64(sessions_ht, &session->session_n);
return session;

error:
return session;
free(session);
return NULL;
}

/* Should be called with RCU read-side lock held. */
Expand Down

0 comments on commit bb5d54e

Please sign in to comment.