Relay protocol: check string lengths

[lttng-tools.git] / src / bin / lttng-relayd / cmd-2-1.c

diff --git a/src/bin/lttng-relayd/cmd-2-1.c b/src/bin/lttng-relayd/cmd-2-1.c
index a9e55c6acb866d427cbf20d6271dee3f4a848155..080dc173fc8361b117b4d335c3c2895bd075342f 100644 (file)
--- a/src/bin/lttng-relayd/cmd-2-1.c
+++ b/src/bin/lttng-relayd/cmd-2-1.c
@@ -19,10 +19,11 @@
 
 #define _LGPL_SOURCE
 #include <assert.h>
-#include <string.h>
 
 #include <common/common.h>
 #include <common/sessiond-comm/relayd.h>
+#include <common/compat/string.h>
+#include <lttng/constant.h>
 
 #include "cmd-generic.h"
 #include "cmd-2-1.h"
@@ -38,6 +39,7 @@ int cmd_recv_stream_2_1(struct relay_connection *conn,
        struct lttcomm_relayd_add_stream stream_info;
        char *path_name = NULL;
        char *channel_name = NULL;
+       size_t len;
 
        ret = cmd_recv(conn->sock, &stream_info, sizeof(stream_info));
        if (ret < 0) {
@@ -45,17 +47,29 @@ int cmd_recv_stream_2_1(struct relay_connection *conn,
                goto error;
        }
 
+       len = lttng_strnlen(stream_info.pathname, sizeof(stream_info.pathname));
+       /* Ensure that NULL-terminated and fits in local filename length. */
+       if (len == sizeof(stream_info.pathname) || len >= LTTNG_NAME_MAX) {
+               ret = -ENAMETOOLONG;
+               ERR("Path name too long");
+               goto error;
+       }
        path_name = create_output_path(stream_info.pathname);
        if (!path_name) {
                PERROR("Path name allocation");
                ret = -ENOMEM;
                goto error;
        }
-
+       len = lttng_strnlen(stream_info.channel_name, sizeof(stream_info.channel_name));
+       if (len == sizeof(stream_info.channel_name) || len >= DEFAULT_STREAM_NAME_LEN) {
+               ret = -ENAMETOOLONG;
+               ERR("Channel name too long");
+               goto error;
+       }
        channel_name = strdup(stream_info.channel_name);
        if (!channel_name) {
                ret = -errno;
-               PERROR("Path name allocation");
+               PERROR("Channel name allocation");
                goto error;
        }