Fix: lttng-ctl: appending to dynamic buffer invalidates its data member

[lttng-tools.git] / src / lib / lttng-ctl / lttng-ctl.c

diff --git a/src/lib/lttng-ctl/lttng-ctl.c b/src/lib/lttng-ctl/lttng-ctl.c
index 151ceed64ac3f02f86a043898b08e29de03b3e50..5b774e1d6bcbc1e9df4c01efc0e98634e1172e72 100644 (file)
--- a/src/lib/lttng-ctl/lttng-ctl.c
+++ b/src/lib/lttng-ctl/lttng-ctl.c
@@ -653,7 +653,12 @@ int lttng_ctl_ask_sessiond_payload(struct lttng_payload_view *message,
 
        /* Check error code if OK */
        if (llm.ret_code != LTTNG_OK) {
-               ret = -llm.ret_code;
+               if (llm.ret_code < LTTNG_OK || llm.ret_code >= LTTNG_ERR_NR) {
+                       /* Invalid error code received. */
+                       ret = -LTTNG_ERR_UNK;
+               } else {
+                       ret = -llm.ret_code;
+               }
                goto end;
        }
 
@@ -3142,18 +3147,18 @@ int lttng_register_trigger(struct lttng_trigger *trigger)
                goto end;
        }
 
-       /*
-        * This is needed to populate the trigger object size for the command
-        * header.
-       */
-       message_lsm = (struct lttcomm_session_msg *) message.buffer.data;
-
        ret = lttng_trigger_serialize(trigger, &message);
        if (ret < 0) {
                ret = -LTTNG_ERR_UNK;
                goto end;
        }
 
+       /*
+        * This is needed to populate the trigger object size for the command
+        * header.
+        */
+       message_lsm = (struct lttcomm_session_msg *) message.buffer.data;
+
        message_lsm->u.trigger.length = (uint32_t) message.buffer.size - sizeof(lsm);
 
        {