Fix: sessiond: event name truncation during listing

[lttng-tools.git] / src / bin / lttng-sessiond / cmd.c

diff --git a/src/bin/lttng-sessiond/cmd.c b/src/bin/lttng-sessiond/cmd.c
index 86a162baf1f6ddfcefdaf729a286eec7ff8d20e1..96f7433a6345fd90b1f608a272785fe3fc341578 100644 (file)
--- a/src/bin/lttng-sessiond/cmd.c
+++ b/src/bin/lttng-sessiond/cmd.c
@@ -488,8 +488,14 @@ static int list_lttng_agent_events(struct agent *agt,
                        .loglevel_type = agent_event->loglevel_type,
                };
 
-               strncpy(event.name, agent_event->name, sizeof(event.name));
-               event.name[sizeof(event.name) - 1] = '\0';
+               ret = lttng_strncpy(event.name, agent_event->name, sizeof(event.name));
+               if (ret) {
+                       /* Internal error, invalid name. */
+                       ERR("Invalid event name while listing agent events: '%s' exceeds the maximal allowed length of %zu bytes",
+                                       agent_event->name, sizeof(event.name));
+                       ret = -LTTNG_ERR_UNK;
+                       goto end;
+               }
 
                ret = lttng_dynamic_buffer_append(
                                &payload->buffer, &event, sizeof(event));
@@ -556,8 +562,14 @@ static int list_lttng_ust_global_events(char *channel_name,
                        continue;
                }
 
-               strncpy(event.name, uevent->attr.name, sizeof(event.name));
-               event.name[sizeof(event.name) - 1] = '\0';
+               ret = lttng_strncpy(event.name, uevent->attr.name, sizeof(event.name));
+               if (ret) {
+                       /* Internal error, invalid name. */
+                       ERR("Invalid event name while listing user space tracer events: '%s' exceeds the maximal allowed length of %zu bytes",
+                                       uevent->attr.name, sizeof(event.name));
+                       ret = -LTTNG_ERR_UNK;
+                       goto end;
+               }
 
                event.enabled = uevent->enabled;
 
@@ -647,8 +659,16 @@ static int list_lttng_kernel_events(char *channel_name,
        cds_list_for_each_entry(kevent, &kchan->events_list.head , list) {
                struct lttng_event event = {};
 
-               strncpy(event.name, kevent->event->name, sizeof(event.name));
-               event.name[sizeof(event.name) - 1] = '\0';
+               ret = lttng_strncpy(event.name, kevent->event->name, sizeof(event.name));
+               if (ret) {
+                       /* Internal error, invalid name. */
+                       ERR("Invalid event name while listing kernel events: '%s' exceeds the maximal allowed length of %zu bytes",
+                                       kevent->event->name,
+                                       sizeof(event.name));
+                       ret = -LTTNG_ERR_UNK;
+                       goto end;
+               }
+
                event.enabled = kevent->enabled;
                event.filter = (unsigned char) !!kevent->filter_expression;
 
@@ -3107,10 +3127,22 @@ enum lttng_error_code cmd_create_session(struct command_ctx *cmd_ctx, int sock,
                        &payload,
                        0,
                        cmd_ctx->lsm.u.create_session.home_dir_size);
+       if (cmd_ctx->lsm.u.create_session.home_dir_size > 0 &&
+                       !lttng_buffer_view_is_valid(&home_dir_view)) {
+               ERR("Invalid payload in \"create session\" command: buffer too short to contain home directory");
+               ret_code = LTTNG_ERR_INVALID_PROTOCOL;
+               goto error;
+       }
+
        session_descriptor_view = lttng_buffer_view_from_dynamic_buffer(
                        &payload,
                        cmd_ctx->lsm.u.create_session.home_dir_size,
                        cmd_ctx->lsm.u.create_session.session_descriptor_size);
+       if (!lttng_buffer_view_is_valid(&session_descriptor_view)) {
+               ERR("Invalid payload in \"create session\" command: buffer too short to contain session descriptor");
+               ret_code = LTTNG_ERR_INVALID_PROTOCOL;
+               goto error;
+       }
 
        ret = lttng_session_descriptor_create_from_buffer(
                        &session_descriptor_view, &session_descriptor);
@@ -4283,8 +4315,7 @@ int cmd_register_trigger(struct command_ctx *cmd_ctx, int sock,
                        sock, trigger_payload.buffer.data, trigger_len);
        if (sock_recv_len < 0 || sock_recv_len != trigger_len) {
                ERR("Failed to receive \"register trigger\" command payload");
-               /* TODO: should this be a new error enum ? */
-               ret = LTTNG_ERR_INVALID_TRIGGER;
+               ret = LTTNG_ERR_INVALID_PROTOCOL;
                goto end;
        }
 
@@ -4330,6 +4361,15 @@ int cmd_register_trigger(struct command_ctx *cmd_ctx, int sock,
                }
        }
 
+       /*
+        * The bytecode generation also serves as a validation step for the
+        * bytecode expressions.
+        */
+       ret = lttng_trigger_generate_bytecode(trigger, &cmd_creds);
+       if (ret != LTTNG_OK) {
+               goto end;
+       }
+
        /*
         * A reference to the trigger is acquired by the notification thread.
         * It is safe to return the same trigger to the caller since it the
@@ -4438,6 +4478,29 @@ end:
        return ret;
 }
 
+int cmd_list_triggers(struct command_ctx *cmd_ctx,
+               struct notification_thread_handle *notification_thread,
+               struct lttng_triggers **return_triggers)
+{
+       int ret = 0;
+       enum lttng_error_code ret_code;
+       struct lttng_triggers *triggers = NULL;
+
+       /* Get the set of triggers from the notification thread. */
+       ret_code = notification_thread_command_list_triggers(
+                       notification_thread, cmd_ctx->creds.uid, &triggers);
+       if (ret_code != LTTNG_OK) {
+               ret = ret_code;
+               goto end;
+       }
+
+       *return_triggers = triggers;
+       triggers = NULL;
+       ret = LTTNG_OK;
+end:
+       lttng_triggers_destroy(triggers);
+       return ret;
+}
 /*
  * Send relayd sockets from snapshot output to consumer. Ignore request if the
  * snapshot output is *not* set with a remote destination.