From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Date: Tue, 17 May 2016 01:42:41 +0000 (-0400)
Subject: Fix: illegal memory access in _cmd_enable_event
X-Git-Tag: v2.6.3~55
X-Git-Url: http://git.lttng.org/?p=lttng-tools.git;a=commitdiff_plain;h=d092c2f0b85bd5f86cd70ea40429f7e01a998d68

Fix: illegal memory access in _cmd_enable_event

Found by Coverity:

CID 1321742 (#1 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)21. buffer_size_warning: Calling strncpy with a
maximum size argument of 256 bytes on destination array attr->name of
size 256 bytes might leave the destination string unterminated.

CID 1321742 (#2 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)22. buffer_size_warning: Calling strncpy with a
maximum size argument of 256 bytes on destination array attr->name of
size 256 bytes might leave the destination string unterminated.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
---

diff --git a/src/bin/lttng-sessiond/cmd.c b/src/bin/lttng-sessiond/cmd.c
index 6779bae67..a45ec1380 100644
--- a/src/bin/lttng-sessiond/cmd.c
+++ b/src/bin/lttng-sessiond/cmd.c
@@ -1462,7 +1462,12 @@ int cmd_enable_event(struct ltt_session *session, struct lttng_domain *domain,
 				ret = LTTNG_ERR_FATAL;
 				goto error;
 			}
-			strncpy(attr->name, channel_name, sizeof(attr->name));
+			if (lttng_strncpy(attr->name, channel_name,
+					sizeof(attr->name))) {
+				ret = LTTNG_ERR_INVALID;
+				free(attr);
+				goto error;
+			}
 
 			ret = cmd_enable_channel(session, domain, attr, wpipe);
 			if (ret != LTTNG_OK) {
@@ -1540,7 +1545,12 @@ int cmd_enable_event(struct ltt_session *session, struct lttng_domain *domain,
 				ret = LTTNG_ERR_FATAL;
 				goto error;
 			}
-			strncpy(attr->name, channel_name, sizeof(attr->name));
+			if (lttng_strncpy(attr->name, channel_name,
+					sizeof(attr->name))) {
+				ret = LTTNG_ERR_INVALID;
+				free(attr);
+				goto error;
+			}
 
 			ret = cmd_enable_channel(session, domain, attr, wpipe);
 			if (ret != LTTNG_OK) {