Fix: possible unlink on uninitialized buffer path

[lttng-tools.git] / src / bin / lttng-sessiond / save.c

diff --git a/src/bin/lttng-sessiond/save.c b/src/bin/lttng-sessiond/save.c
index 2d8af38217754916ea7080dba0604f479c88027a..22fab9c05bd013020a83c368fc6a0cadf7ad09e3 100644 (file)
--- a/src/bin/lttng-sessiond/save.c
+++ b/src/bin/lttng-sessiond/save.c
@@ -1239,6 +1239,7 @@ end_net_output:
                        ret = !output->dst.net.control_isset ?
                                LTTNG_ERR_URL_CTRL_MISS :
                                LTTNG_ERR_URL_DATA_MISS;
+                       free(uri);
                        goto end;
                }
 
@@ -1397,6 +1398,7 @@ int save_session(struct ltt_session *session,
        struct lttng_save_session_attr *attr, lttng_sock_cred *creds)
 {
        int ret, fd;
+       unsigned int file_opened = 0;   /* Indicate if the file has been opened */
        char config_file_path[PATH_MAX];
        size_t len;
        struct config_writer *writer = NULL;
@@ -1419,7 +1421,7 @@ int save_session(struct ltt_session *session,
        provided_path = lttng_save_session_attr_get_output_url(attr);
        if (provided_path) {
                len = strlen(provided_path);
-               if (len > PATH_MAX) {
+               if (len >= sizeof(config_file_path)) {
                        ret = LTTNG_ERR_SET_URL;
                        goto end;
                }
@@ -1433,7 +1435,7 @@ int save_session(struct ltt_session *session,
                        goto end;
                }
 
-               ret_len = snprintf(config_file_path, PATH_MAX,
+               ret_len = snprintf(config_file_path, sizeof(config_file_path),
                                DEFAULT_SESSION_HOME_CONFIGPATH, home_dir);
                free(home_dir);
                if (ret_len < 0) {
@@ -1445,11 +1447,12 @@ int save_session(struct ltt_session *session,
        }
 
        /*
-        * Check the path fits in PATH_MAX, including the / followed by trailing
-        * .lttng extension and the NULL terminated string.
+        * Check the path fits in the config file path dst including the '/'
+        * followed by trailing .lttng extension and the NULL terminated string.
         */
-       if (len + session_name_len + 2 +
-                       sizeof(DEFAULT_SESSION_CONFIG_FILE_EXTENSION) > PATH_MAX) {
+       if ((len + session_name_len + 2 +
+                       sizeof(DEFAULT_SESSION_CONFIG_FILE_EXTENSION))
+                       > sizeof(config_file_path)) {
                ret = LTTNG_ERR_SET_URL;
                goto end;
        }
@@ -1461,6 +1464,10 @@ int save_session(struct ltt_session *session,
                goto end;
        }
 
+       /*
+        * At this point, we know that everything fits in the buffer. Validation
+        * was done just above.
+        */
        config_file_path[len++] = '/';
        strncpy(config_file_path + len, session->name, session_name_len);
        len += session_name_len;
@@ -1479,6 +1486,7 @@ int save_session(struct ltt_session *session,
                ret = LTTNG_ERR_SAVE_IO_FAIL;
                goto end;
        }
+       file_opened = 1;
 
        writer = config_writer_create(fd);
        if (!writer) {
@@ -1573,7 +1581,7 @@ end:
        }
        if (ret) {
                /* Delete file in case of error */
-               if (unlink(config_file_path)) {
+               if (file_opened && unlink(config_file_path)) {
                        PERROR("Unlinking XML session configuration.");
                }
        }