Fix: unchecked buffer size for communication header

[lttng-tools.git] / src / bin / lttng-sessiond / client.c

diff --git a/src/bin/lttng-sessiond/client.c b/src/bin/lttng-sessiond/client.c
index 689dc258a604cff0f3d7816f72ff8778523f8cd5..ecd31ea48b11159d56b3f350f15d58b40eb19114 100644 (file)
--- a/src/bin/lttng-sessiond/client.c
+++ b/src/bin/lttng-sessiond/client.c
@@ -31,6 +31,7 @@
 #include <signal.h>
 #include <stddef.h>
 #include <sys/stat.h>
+#include <unistd.h>
 
 #include "client.h"
 #include "lttng-sessiond.h"
@@ -579,15 +580,14 @@ static unsigned int lttng_sessions_count(uid_t uid, gid_t gid)
        struct ltt_session *session;
        const struct ltt_session_list *session_list = session_get_list();
 
-       DBG("Counting number of available session for UID %d GID %d",
-                       uid, gid);
+       DBG("Counting number of available session for UID %d", uid);
        cds_list_for_each_entry(session, &session_list->head, list) {
                if (!session_get(session)) {
                        continue;
                }
                session_lock(session);
                /* Only count the sessions the user can control. */
-               if (session_access_ok(session, uid, gid) &&
+               if (session_access_ok(session, uid) &&
                                !session->destroyed) {
                        i++;
                }
@@ -1106,13 +1106,12 @@ skip_domain:
        }
 
        /*
-        * Check that the UID or GID match that of the tracing session.
+        * Check that the UID matches that of the tracing session.
         * The root user can interact with all sessions.
         */
        if (need_tracing_session) {
                if (!session_access_ok(cmd_ctx->session,
-                               LTTNG_SOCK_GET_UID_CRED(&cmd_ctx->creds),
-                               LTTNG_SOCK_GET_GID_CRED(&cmd_ctx->creds)) ||
+                               LTTNG_SOCK_GET_UID_CRED(&cmd_ctx->creds)) ||
                                cmd_ctx->session->destroyed) {
                        ret = LTTNG_ERR_EPERM;
                        goto error;
@@ -1283,9 +1282,17 @@ error_add_context:
                                                .value_type;
                struct process_attr_value *value;
                enum lttng_error_code ret_code;
+               long login_name_max;
+
+               login_name_max = sysconf(_SC_LOGIN_NAME_MAX);
+               if (login_name_max < 0) {
+                       PERROR("Failed to get _SC_LOGIN_NAME_MAX system configuration");
+                       ret = LTTNG_ERR_INVALID;
+                       goto error;
+               }
 
                /* Receive remaining variable length payload if applicable. */
-               if (name_len > LOGIN_NAME_MAX) {
+               if (name_len > login_name_max) {
                        /*
                         * POSIX mandates user and group names that are at least
                         * 8 characters long. Note that although shadow-utils
@@ -1293,9 +1300,9 @@ error_add_context:
                         * limit (from bits/utmp.h, UT_NAMESIZE),
                         * LOGIN_NAME_MAX is defined to 256.
                         */
-                       ERR("Rejecting process attribute tracker value %s as the provided exceeds the maximal allowed length: argument length = %zu, maximal length = %d",
+                       ERR("Rejecting process attribute tracker value %s as the provided exceeds the maximal allowed length: argument length = %zu, maximal length = %ld",
                                        add_value ? "addition" : "removal",
-                                       name_len, LOGIN_NAME_MAX);
+                                       name_len, login_name_max);
                        ret = LTTNG_ERR_INVALID;
                        goto error;
                }
@@ -1327,6 +1334,11 @@ error_add_context:
 
                payload_view = lttng_buffer_view_from_dynamic_buffer(
                                &payload, 0, name_len);
+               if (name_len > 0 && !lttng_buffer_view_is_valid(&payload_view)) {
+                       ret = LTTNG_ERR_INVALID_PROTOCOL;
+                       goto error_add_remove_tracker_value;
+               }
+
                /*
                 * Validate the value type and domains are legal for the process
                 * attribute tracker that is specified and convert the value to
@@ -2026,8 +2038,41 @@ error_add_context:
        }
        case LTTNG_REGISTER_TRIGGER:
        {
+               struct lttng_trigger *return_trigger;
+               size_t original_payload_size;
+               size_t payload_size;
+
+               ret = setup_empty_lttng_msg(cmd_ctx);
+               if (ret) {
+                       ret = LTTNG_ERR_NOMEM;
+                       goto setup_error;
+               }
+
+               original_payload_size = cmd_ctx->reply_payload.buffer.size;
+
                ret = cmd_register_trigger(cmd_ctx, *sock,
-                               notification_thread_handle);
+                               notification_thread_handle, &return_trigger);
+               if (ret != LTTNG_OK) {
+                       goto error;
+               }
+
+               ret = lttng_trigger_serialize(return_trigger, &cmd_ctx->reply_payload);
+               if (ret) {
+                       ERR("Failed to serialize trigger in reply to \"register trigger\" command");
+                       ret = LTTNG_ERR_NOMEM;
+                       lttng_trigger_destroy(return_trigger);
+                       goto error;
+               }
+
+               lttng_trigger_destroy(return_trigger);
+               return_trigger = NULL;
+
+               payload_size = cmd_ctx->reply_payload.buffer.size -
+                       original_payload_size;
+
+               update_lttng_msg(cmd_ctx, 0, payload_size);
+
+               ret = LTTNG_OK;
                break;
        }
        case LTTNG_UNREGISTER_TRIGGER: