Fix: unchecked buffer size for communication header
[lttng-tools.git] / src / bin / lttng-relayd / cmd-2-11.c
CommitLineData
f86f6389 1/*
ab5be9fa 2 * Copyright (C) 2018 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
f86f6389 3 *
ab5be9fa 4 * SPDX-License-Identifier: GPL-2.0-only
f86f6389 5 *
f86f6389
JR
6 */
7
8#define _LGPL_SOURCE
9#include <assert.h>
10#include <inttypes.h>
11
12#include <common/common.h>
13#include <common/sessiond-comm/relayd.h>
14
15#include <common/compat/endian.h>
16#include <common/compat/string.h>
17#include <lttng/constant.h>
18
19#include "cmd-2-11.h"
2f21a469 20#include "utils.h"
f86f6389
JR
21
22int cmd_create_session_2_11(const struct lttng_buffer_view *payload,
6fa5fe7c 23 char *session_name, char *hostname, char *base_path,
23c8ff50 24 uint32_t *live_timer, bool *snapshot,
1e791a74 25 uint64_t *id_sessiond, lttng_uuid sessiond_uuid,
db1da059 26 bool *has_current_chunk, uint64_t *current_chunk_id,
46ef2188
MD
27 time_t *creation_time,
28 bool *session_name_contains_creation_time)
f86f6389
JR
29{
30 int ret;
31 struct lttcomm_relayd_create_session_2_11 header;
6fa5fe7c 32 size_t header_len, received_names_size, offset;
f86f6389
JR
33 struct lttng_buffer_view session_name_view;
34 struct lttng_buffer_view hostname_view;
6fa5fe7c 35 struct lttng_buffer_view base_path_view;
f86f6389
JR
36
37 header_len = sizeof(header);
38
39 if (payload->size < header_len) {
40 ERR("Unexpected payload size in \"cmd_create_session_2_11\": expected >= %zu bytes, got %zu bytes",
41 header_len, payload->size);
42 ret = -1;
43 goto error;
44 }
45 memcpy(&header, payload->data, header_len);
46
47 header.session_name_len = be32toh(header.session_name_len);
48 header.hostname_len = be32toh(header.hostname_len);
6fa5fe7c 49 header.base_path_len = be32toh(header.base_path_len);
f86f6389 50 header.live_timer = be32toh(header.live_timer);
84fa4db5
JG
51 header.current_chunk_id.value = be64toh(header.current_chunk_id.value);
52 header.current_chunk_id.is_set = !!header.current_chunk_id.is_set;
db1da059 53 header.creation_time = be64toh(header.creation_time);
f86f6389 54
23c8ff50
JG
55 lttng_uuid_copy(sessiond_uuid, header.sessiond_uuid);
56
6fa5fe7c
MD
57 received_names_size = header.session_name_len + header.hostname_len +
58 header.base_path_len;
f86f6389
JR
59 if (payload->size < header_len + received_names_size) {
60 ERR("Unexpected payload size in \"cmd_create_session_2_11\": expected >= %zu bytes, got %zu bytes",
61 header_len + received_names_size, payload->size);
62 ret = -1;
63 goto error;
64 }
65
66 /* Validate length against defined constant. */
67 if (header.session_name_len > LTTNG_NAME_MAX) {
68 ret = -ENAMETOOLONG;
69 ERR("Length of session name (%" PRIu32 " bytes) received in create_session command exceeds maximum length (%d bytes)", header.session_name_len, LTTNG_NAME_MAX);
70 goto error;
e7f8eff3
JG
71 } else if (header.session_name_len == 0) {
72 ret = -EINVAL;
73 ERR("Illegal session name length of 0 received");
74 goto error;
f86f6389
JR
75 }
76 if (header.hostname_len > LTTNG_HOST_NAME_MAX) {
77 ret = -ENAMETOOLONG;
78 ERR("Length of hostname (%" PRIu32 " bytes) received in create_session command exceeds maximum length (%d bytes)", header.hostname_len, LTTNG_HOST_NAME_MAX);
79 goto error;
80 }
6fa5fe7c
MD
81 if (header.base_path_len > LTTNG_PATH_MAX) {
82 ret = -ENAMETOOLONG;
83 ERR("Length of base_path (%" PRIu32 " bytes) received in create_session command exceeds maximum length (%d bytes)", header.base_path_len, PATH_MAX);
84 goto error;
85 }
f86f6389 86
6fa5fe7c
MD
87 offset = header_len;
88 session_name_view = lttng_buffer_view_from_view(payload, offset,
f86f6389 89 header.session_name_len);
3e6e0df2
JG
90 if (!lttng_buffer_view_is_valid(&session_name_view)) {
91 ERR("Invalid payload in \"cmd_create_session_2_11\": buffer too short to contain session name");
92 ret = -1;
93 goto error;
94 }
95
6fa5fe7c 96 offset += header.session_name_len;
f86f6389 97 hostname_view = lttng_buffer_view_from_view(payload,
6fa5fe7c 98 offset, header.hostname_len);
3e6e0df2
JG
99 if (!lttng_buffer_view_is_valid(&hostname_view)) {
100 ERR("Invalid payload in \"cmd_create_session_2_11\": buffer too short to contain hostname");
101 ret = -1;
102 goto error;
103 }
104
6fa5fe7c
MD
105 offset += header.hostname_len;
106 base_path_view = lttng_buffer_view_from_view(payload,
107 offset, header.base_path_len);
3e6e0df2
JG
108 if (header.base_path_len > 0 && !lttng_buffer_view_is_valid(&base_path_view)) {
109 ERR("Invalid payload in \"cmd_create_session_2_11\": buffer too short to contain base path");
110 ret = -1;
111 goto error;
112 }
f86f6389
JR
113
114 /* Validate that names are NULL terminated. */
115 if (session_name_view.data[session_name_view.size - 1] != '\0') {
116 ERR("cmd_create_session_2_11 session_name is invalid (not NULL terminated)");
117 ret = -1;
118 goto error;
119 }
120
121 if (hostname_view.data[hostname_view.size - 1] != '\0') {
122 ERR("cmd_create_session_2_11 hostname is invalid (not NULL terminated)");
123 ret = -1;
124 goto error;
125 }
126
6fa5fe7c
MD
127 if (base_path_view.size != 0 &&
128 base_path_view.data[base_path_view.size - 1] != '\0') {
129 ERR("cmd_create_session_2_11 base_path is invalid (not NULL terminated)");
130 ret = -1;
131 goto error;
132 }
133
f86f6389
JR
134 /*
135 * Length and null-termination check are already performed.
6fa5fe7c 136 * LTTNG_NAME_MAX, LTTNG_HOST_NAME_MAX, and LTTNG_PATH_MAX max sizes are expected.
f86f6389
JR
137 */
138 strcpy(session_name, session_name_view.data);
139 strcpy(hostname, hostname_view.data);
6fa5fe7c 140 strcpy(base_path, base_path_view.size ? base_path_view.data : "");
f86f6389
JR
141
142 *live_timer = header.live_timer;
143 *snapshot = !!header.snapshot;
84fa4db5
JG
144 *current_chunk_id = header.current_chunk_id.value;
145 *has_current_chunk = header.current_chunk_id.is_set;
db1da059 146 *creation_time = (time_t) header.creation_time;
46ef2188
MD
147 *session_name_contains_creation_time =
148 header.session_name_contains_creation_time;
f86f6389
JR
149
150 ret = 0;
151
152error:
153 return ret;
154}
2f21a469
JR
155
156/*
157 * cmd_recv_stream_2_11 allocates path_name and channel_name.
158 */
159int cmd_recv_stream_2_11(const struct lttng_buffer_view *payload,
160 char **ret_path_name, char **ret_channel_name,
0b50e4b3
JG
161 uint64_t *tracefile_size, uint64_t *tracefile_count,
162 uint64_t *trace_archive_id)
2f21a469
JR
163{
164 int ret;
165 struct lttcomm_relayd_add_stream_2_11 header;
166 size_t header_len, received_names_size;
167 struct lttng_buffer_view channel_name_view;
168 struct lttng_buffer_view pathname_view;
169 char *path_name = NULL;
170 char *channel_name = NULL;
171
172 header_len = sizeof(header);
173
174 if (payload->size < header_len) {
175 ERR("Unexpected payload size in \"cmd_recv_stream_2_11\": expected >= %zu bytes, got %zu bytes",
176 header_len, payload->size);
177 ret = -1;
178 goto error;
179 }
180 memcpy(&header, payload->data, header_len);
181
182 header.channel_name_len = be32toh(header.channel_name_len);
183 header.pathname_len = be32toh(header.pathname_len);
184 header.tracefile_size = be64toh(header.tracefile_size);
185 header.tracefile_count = be64toh(header.tracefile_count);
348a81dc 186 header.trace_chunk_id = be64toh(header.trace_chunk_id);
2f21a469
JR
187
188 received_names_size = header.channel_name_len + header.pathname_len;
189 if (payload->size < header_len + received_names_size) {
190 ERR("Unexpected payload size in \"cmd_recv_stream_2_11\": expected >= %zu bytes, got %zu bytes",
191 header_len + received_names_size, payload->size);
192 ret = -1;
193 goto error;
194 }
195
196 /* Validate length against defined constant. */
197 if (header.channel_name_len > DEFAULT_STREAM_NAME_LEN) {
198 ret = -ENAMETOOLONG;
199 ERR("Channel name too long");
200 goto error;
201 }
202 if (header.pathname_len > LTTNG_NAME_MAX) {
203 ret = -ENAMETOOLONG;
204 ERR("Pathname too long");
205 goto error;
206 }
207
208 /* Validate that names are (NULL terminated. */
209 channel_name_view = lttng_buffer_view_from_view(payload, header_len,
3e6e0df2
JG
210 header.channel_name_len);
211 if (!lttng_buffer_view_is_valid(&channel_name_view)) {
212 ERR("Invalid payload received in \"cmd_recv_stream_2_11\": buffer too short for channel name");
213 ret = -1;
214 goto error;
215 }
2f21a469
JR
216
217 if (channel_name_view.data[channel_name_view.size - 1] != '\0') {
218 ERR("cmd_recv_stream_2_11 channel_name is invalid (not NULL terminated)");
219 ret = -1;
220 goto error;
221 }
222
3e6e0df2
JG
223 pathname_view = lttng_buffer_view_from_view(payload,
224 header_len + header.channel_name_len, header.pathname_len);
225 if (!lttng_buffer_view_is_valid(&pathname_view)) {
226 ERR("Invalid payload received in \"cmd_recv_stream_2_11\": buffer too short for path name");
227 ret = -1;
228 goto error;
229 }
230
2f21a469
JR
231 if (pathname_view.data[pathname_view.size - 1] != '\0') {
232 ERR("cmd_recv_stream_2_11 patname is invalid (not NULL terminated)");
233 ret = -1;
234 goto error;
235 }
236
237 channel_name = strdup(channel_name_view.data);
238 if (!channel_name) {
239 ret = -errno;
240 PERROR("Channel name allocation");
241 goto error;
242 }
243
348a81dc 244 path_name = strdup(pathname_view.data);
2f21a469
JR
245 if (!path_name) {
246 PERROR("Path name allocation");
247 ret = -ENOMEM;
248 goto error;
249 }
250
251 *tracefile_size = header.tracefile_size;
252 *tracefile_count = header.tracefile_count;
348a81dc 253 *trace_archive_id = header.trace_chunk_id;
2f21a469
JR
254 *ret_path_name = path_name;
255 *ret_channel_name = channel_name;
256 /* Move ownership to caller */
257 path_name = NULL;
258 channel_name = NULL;
259 ret = 0;
260error:
261 free(channel_name);
262 free(path_name);
263 return ret;
264}
This page took 0.061983 seconds and 4 git commands to generate.