Skip to content

Commit bfc3fb1

Browse files
compudjjgalar
authored andcommitted
Fix: illegal memory access in viewer_list_sessions
Found by Coverity: CID 1243025 (#1 of 2): Buffer not null terminated (BUFFER_SIZE_WARNING)17. buffer_size_warning: Calling strncpy with a maximum size argument of 64 bytes on destination array send_session->hostname of size 64 bytes might leave the destination string unterminated. CID 1243025 (#2 of 2): Buffer not null terminated (BUFFER_SIZE_WARNING)17. buffer_size_warning: Calling strncpy with a maximum size argument of 255 bytes on destination array send_session->session_name of size 255 bytes might leave the destination string unterminated. Signed-off-by: Mathieu Desnoyers <[email protected]> Signed-off-by: Jérémie Galarneau <[email protected]>
1 parent a7c918a commit bfc3fb1

File tree

1 file changed

+13
-4
lines changed

1 file changed

+13
-4
lines changed

src/bin/lttng-relayd/live.c

+13-4
Original file line numberDiff line numberDiff line change
@@ -831,10 +831,19 @@ int viewer_list_sessions(struct relay_connection *conn)
831831
buf_count = new_buf_count;
832832
}
833833
send_session = &send_session_buf[count];
834-
strncpy(send_session->session_name, session->session_name,
835-
sizeof(send_session->session_name));
836-
strncpy(send_session->hostname, session->hostname,
837-
sizeof(send_session->hostname));
834+
if (lttng_strncpy(send_session->session_name,
835+
session->session_name,
836+
sizeof(send_session->session_name))) {
837+
ret = -1;
838+
rcu_read_unlock();
839+
goto end_free;
840+
}
841+
if (lttng_strncpy(send_session->hostname, session->hostname,
842+
sizeof(send_session->hostname))) {
843+
ret = -1;
844+
rcu_read_unlock();
845+
goto end_free;
846+
}
838847
send_session->id = htobe64(session->id);
839848
send_session->live_timer = htobe32(session->live_timer);
840849
if (session->viewer_attached) {

0 commit comments

Comments
 (0)