Fix: unchecked buffer size for communication header
[lttng-tools.git] / src / bin / lttng-relayd / cmd-2-11.c
index e2d71a0d1351f848a1df2493b6554e737b303278..cd23f22d6f3405bcf9913db0c4d97dff7b6736dc 100644 (file)
@@ -1,18 +1,8 @@
 /*
- * Copyright (C) 2018 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
+ * Copyright (C) 2018 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
  *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License, version 2 only, as
- * published by the Free Software Foundation.
+ * SPDX-License-Identifier: GPL-2.0-only
  *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 51
- * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
 #define _LGPL_SOURCE
 #include "utils.h"
 
 int cmd_create_session_2_11(const struct lttng_buffer_view *payload,
-               char *session_name, char *hostname,
-               uint32_t *live_timer, bool *snapshot)
+               char *session_name, char *hostname, char *base_path,
+               uint32_t *live_timer, bool *snapshot,
+               uint64_t *id_sessiond, lttng_uuid sessiond_uuid,
+               bool *has_current_chunk, uint64_t *current_chunk_id,
+               time_t *creation_time,
+               bool *session_name_contains_creation_time)
 {
        int ret;
        struct lttcomm_relayd_create_session_2_11 header;
-       size_t header_len, received_names_size;
+       size_t header_len, received_names_size, offset;
        struct lttng_buffer_view session_name_view;
        struct lttng_buffer_view hostname_view;
+       struct lttng_buffer_view base_path_view;
 
        header_len = sizeof(header);
 
@@ -51,9 +46,16 @@ int cmd_create_session_2_11(const struct lttng_buffer_view *payload,
 
        header.session_name_len = be32toh(header.session_name_len);
        header.hostname_len = be32toh(header.hostname_len);
+       header.base_path_len = be32toh(header.base_path_len);
        header.live_timer = be32toh(header.live_timer);
+       header.current_chunk_id.value = be64toh(header.current_chunk_id.value);
+       header.current_chunk_id.is_set = !!header.current_chunk_id.is_set;
+       header.creation_time = be64toh(header.creation_time);
+
+       lttng_uuid_copy(sessiond_uuid, header.sessiond_uuid);
 
-       received_names_size = header.session_name_len + header.hostname_len;
+       received_names_size = header.session_name_len + header.hostname_len +
+                               header.base_path_len;
        if (payload->size < header_len + received_names_size) {
                ERR("Unexpected payload size in \"cmd_create_session_2_11\": expected >= %zu bytes, got %zu bytes",
                                header_len + received_names_size, payload->size);
@@ -66,17 +68,48 @@ int cmd_create_session_2_11(const struct lttng_buffer_view *payload,
                ret = -ENAMETOOLONG;
                ERR("Length of session name (%" PRIu32 " bytes) received in create_session command exceeds maximum length (%d bytes)", header.session_name_len, LTTNG_NAME_MAX);
                goto error;
+       } else if (header.session_name_len == 0) {
+               ret = -EINVAL;
+               ERR("Illegal session name length of 0 received");
+               goto error;
        }
        if (header.hostname_len > LTTNG_HOST_NAME_MAX) {
                ret = -ENAMETOOLONG;
                ERR("Length of hostname (%" PRIu32 " bytes) received in create_session command exceeds maximum length (%d bytes)", header.hostname_len, LTTNG_HOST_NAME_MAX);
                goto error;
        }
+       if (header.base_path_len > LTTNG_PATH_MAX) {
+               ret = -ENAMETOOLONG;
+               ERR("Length of base_path (%" PRIu32 " bytes) received in create_session command exceeds maximum length (%d bytes)", header.base_path_len, PATH_MAX);
+               goto error;
+       }
 
-       session_name_view = lttng_buffer_view_from_view(payload, header_len,
+       offset = header_len;
+       session_name_view = lttng_buffer_view_from_view(payload, offset,
                        header.session_name_len);
+       if (!lttng_buffer_view_is_valid(&session_name_view)) {
+               ERR("Invalid payload in \"cmd_create_session_2_11\": buffer too short to contain session name");
+               ret = -1;
+               goto error;
+       }
+
+       offset += header.session_name_len;
        hostname_view = lttng_buffer_view_from_view(payload,
-                       header_len + header.session_name_len, header.hostname_len);
+                       offset, header.hostname_len);
+       if (!lttng_buffer_view_is_valid(&hostname_view)) {
+               ERR("Invalid payload in \"cmd_create_session_2_11\": buffer too short to contain hostname");
+               ret = -1;
+               goto error;
+       }
+
+       offset += header.hostname_len;
+       base_path_view = lttng_buffer_view_from_view(payload,
+                       offset, header.base_path_len);
+       if (header.base_path_len > 0 && !lttng_buffer_view_is_valid(&base_path_view)) {
+               ERR("Invalid payload in \"cmd_create_session_2_11\": buffer too short to contain base path");
+               ret = -1;
+               goto error;
+       }
 
        /* Validate that names are NULL terminated. */
        if (session_name_view.data[session_name_view.size - 1] != '\0') {
@@ -91,15 +124,28 @@ int cmd_create_session_2_11(const struct lttng_buffer_view *payload,
                goto error;
        }
 
+       if (base_path_view.size != 0 &&
+                       base_path_view.data[base_path_view.size - 1] != '\0') {
+               ERR("cmd_create_session_2_11 base_path is invalid (not NULL terminated)");
+               ret = -1;
+               goto error;
+       }
+
        /*
         * Length and null-termination check are already performed.
-        * LTTNG_NAME_MAX and LTTNG_HOST_NAME_MAX max size are expected.
+        * LTTNG_NAME_MAX, LTTNG_HOST_NAME_MAX, and LTTNG_PATH_MAX max sizes are expected.
         */
        strcpy(session_name, session_name_view.data);
        strcpy(hostname, hostname_view.data);
+       strcpy(base_path, base_path_view.size ? base_path_view.data : "");
 
        *live_timer = header.live_timer;
        *snapshot = !!header.snapshot;
+       *current_chunk_id = header.current_chunk_id.value;
+       *has_current_chunk = header.current_chunk_id.is_set;
+       *creation_time = (time_t) header.creation_time;
+       *session_name_contains_creation_time =
+               header.session_name_contains_creation_time;
 
        ret = 0;
 
@@ -137,7 +183,7 @@ int cmd_recv_stream_2_11(const struct lttng_buffer_view *payload,
        header.pathname_len = be32toh(header.pathname_len);
        header.tracefile_size = be64toh(header.tracefile_size);
        header.tracefile_count = be64toh(header.tracefile_count);
-       header.trace_archive_id = be64toh(header.trace_archive_id);
+       header.trace_chunk_id = be64toh(header.trace_chunk_id);
 
        received_names_size = header.channel_name_len + header.pathname_len;
        if (payload->size < header_len + received_names_size) {
@@ -161,9 +207,12 @@ int cmd_recv_stream_2_11(const struct lttng_buffer_view *payload,
 
        /* Validate that names are (NULL terminated. */
        channel_name_view = lttng_buffer_view_from_view(payload, header_len,
-                           header.channel_name_len);
-       pathname_view = lttng_buffer_view_from_view(payload,
-                       header_len + header.channel_name_len, header.pathname_len);
+                       header.channel_name_len);
+       if (!lttng_buffer_view_is_valid(&channel_name_view)) {
+               ERR("Invalid payload received in \"cmd_recv_stream_2_11\": buffer too short for channel name");
+               ret = -1;
+               goto error;
+       }
 
        if (channel_name_view.data[channel_name_view.size - 1] != '\0') {
                ERR("cmd_recv_stream_2_11 channel_name is invalid (not NULL terminated)");
@@ -171,6 +220,14 @@ int cmd_recv_stream_2_11(const struct lttng_buffer_view *payload,
                goto error;
        }
 
+       pathname_view = lttng_buffer_view_from_view(payload,
+                       header_len + header.channel_name_len, header.pathname_len);
+       if (!lttng_buffer_view_is_valid(&pathname_view)) {
+               ERR("Invalid payload received in \"cmd_recv_stream_2_11\": buffer too short for path name");
+               ret = -1;
+               goto error;
+       }
+
        if (pathname_view.data[pathname_view.size - 1] != '\0') {
                ERR("cmd_recv_stream_2_11 patname is invalid (not NULL terminated)");
                ret = -1;
@@ -184,7 +241,7 @@ int cmd_recv_stream_2_11(const struct lttng_buffer_view *payload,
                goto error;
        }
 
-       path_name = create_output_path(pathname_view.data);
+       path_name = strdup(pathname_view.data);
        if (!path_name) {
                PERROR("Path name allocation");
                ret = -ENOMEM;
@@ -193,7 +250,7 @@ int cmd_recv_stream_2_11(const struct lttng_buffer_view *payload,
 
        *tracefile_size = header.tracefile_size;
        *tracefile_count = header.tracefile_count;
-       *trace_archive_id = header.trace_archive_id;
+       *trace_archive_id = header.trace_chunk_id;
        *ret_path_name = path_name;
        *ret_channel_name = channel_name;
        /* Move ownership to caller */
This page took 0.025438 seconds and 4 git commands to generate.