Fix: illegal memory access in add_uri_to_consumer

[lttng-tools.git] / src / bin / lttng-sessiond / cmd.c

diff --git a/src/bin/lttng-sessiond/cmd.c b/src/bin/lttng-sessiond/cmd.c
index b72b091989ce8ae001cba95bd53c6f5c6d92b0b9..1327e42e4ddfa8efdd5a550179000a8f77f34150 100644 (file)
--- a/src/bin/lttng-sessiond/cmd.c
+++ b/src/bin/lttng-sessiond/cmd.c
@@ -758,12 +758,15 @@ static int add_uri_to_consumer(struct consumer_output *consumer,
                DBG2("Setting trace directory path from URI to %s", uri->dst.path);
                memset(consumer->dst.trace_path, 0,
                                sizeof(consumer->dst.trace_path));
-               strncpy(consumer->dst.trace_path, uri->dst.path,
-                               sizeof(consumer->dst.trace_path));
+               /* Explicit length checks for strcpy and strcat. */
+               if (strlen(uri->dst.path) + strlen(default_trace_dir)
+                               >= sizeof(consumer->dst.trace_path)) {
+                       ret = LTTNG_ERR_FATAL;
+                       goto error;
+               }
+               strcpy(consumer->dst.trace_path, uri->dst.path);
                /* Append default trace dir */
-               strncat(consumer->dst.trace_path, default_trace_dir,
-                               sizeof(consumer->dst.trace_path) -
-                               strlen(consumer->dst.trace_path) - 1);
+               strcat(consumer->dst.trace_path, default_trace_dir);
                /* Flag consumer as local. */
                consumer->type = CONSUMER_DST_LOCAL;
                break;
@@ -1810,7 +1813,7 @@ static int _cmd_enable_event(struct ltt_session *session,
                int wpipe, bool internal_event)
 {
        int ret, channel_created = 0;
-       struct lttng_channel *attr;
+       struct lttng_channel *attr = NULL;
 
        assert(session);
        assert(event);
@@ -1856,17 +1859,13 @@ static int _cmd_enable_event(struct ltt_session *session,
                        if (lttng_strncpy(attr->name, channel_name,
                                        sizeof(attr->name))) {
                                ret = LTTNG_ERR_INVALID;
-                               free(attr);
                                goto error;
                        }
 
                        ret = cmd_enable_channel(session, domain, attr, wpipe);
                        if (ret != LTTNG_OK) {
-                               free(attr);
                                goto error;
                        }
-                       free(attr);
-
                        channel_created = 1;
                }
 
@@ -1998,16 +1997,13 @@ static int _cmd_enable_event(struct ltt_session *session,
                        if (lttng_strncpy(attr->name, channel_name,
                                        sizeof(attr->name))) {
                                ret = LTTNG_ERR_INVALID;
-                               free(attr);
                                goto error;
                        }
 
                        ret = cmd_enable_channel(session, domain, attr, wpipe);
                        if (ret != LTTNG_OK) {
-                               free(attr);
                                goto error;
                        }
-                       free(attr);
 
                        /* Get the newly created channel reference back */
                        uchan = trace_ust_find_channel_by_name(
@@ -2182,6 +2178,7 @@ error:
        free(filter_expression);
        free(filter);
        free(exclusion);
+       free(attr);
        rcu_read_unlock();
        return ret;
 }