Fix: scanf unbounded input

[lttng-tools.git] / src / bin / lttng / conf.c

diff --git a/src/bin/lttng/conf.c b/src/bin/lttng/conf.c
index 7d537d1f6d654ab5dce83fa65adf333ed14e4bf4..55ed6352663e8f71dd2f496bf48cf5696d586bec 100644 (file)
--- a/src/bin/lttng/conf.c
+++ b/src/bin/lttng/conf.c
@@ -25,6 +25,7 @@
 #include <unistd.h>
 
 #include <common/error.h>
+#include <common/utils.h>
 
 #include "conf.h"
 
@@ -40,6 +41,7 @@ char *config_get_file_path(char *path)
        ret = asprintf(&file_path, "%s/%s", path, CONFIG_FILENAME);
        if (ret < 0) {
                ERR("Fail allocating config file path");
+               file_path = NULL;
        }
 
        return file_path;
@@ -65,9 +67,7 @@ static FILE *open_config(char *path, const char *mode)
        }
 
 error:
-       if (file_path) {
-               free(file_path);
-       }
+       free(file_path);
        return fp;
 }
 
@@ -116,19 +116,13 @@ static int write_config(char *file_path, size_t size, char *data)
        if (len != 1) {
                ret = -1;
        }
-       fclose(fp);
+       if (fclose(fp)) {
+               PERROR("close write_config");
+       }
 end:
        return ret;
 }
 
-/*
- * Returns the HOME directory path. Caller MUST NOT free(3) the return pointer.
- */
-char *config_get_default_path(void)
-{
-       return getenv("HOME");
-}
-
 /*
  * Destroys directory config and file config.
  */
@@ -160,7 +154,7 @@ end:
  */
 void config_destroy_default(void)
 {
-       char *path = config_get_default_path();
+       char *path = utils_get_home_dir();
        if (path == NULL) {
                return;
        }
@@ -192,6 +186,9 @@ char *config_read_session_name(char *path)
        int ret;
        FILE *fp;
        char var[NAME_MAX], *session_name;
+#if (NAME_MAX == 255)
+#define NAME_MAX_SCANF_IS_A_BROKEN_API "254"
+#endif
 
        session_name = malloc(NAME_MAX);
        if (session_name == NULL) {
@@ -203,11 +200,14 @@ char *config_read_session_name(char *path)
        if (fp == NULL) {
                ERR("Can't find valid lttng config %s/.lttngrc", path);
                MSG("Did you create a session? (lttng create <my_session>)");
+               free(session_name);
                goto error;
        }
 
        while (!feof(fp)) {
-               if ((ret = fscanf(fp, "%[^'=']=%s\n", var, session_name)) != 2) {
+               if ((ret = fscanf(fp, "%" NAME_MAX_SCANF_IS_A_BROKEN_API
+                               "[^'=']=%" NAME_MAX_SCANF_IS_A_BROKEN_API "s\n",
+                               var, session_name)) != 2) {
                        if (ret == -1) {
                                ERR("Missing session=NAME in config file.");
                                goto error_close;
@@ -221,13 +221,20 @@ char *config_read_session_name(char *path)
        }
 
 error_close:
-       fclose(fp);
+       free(session_name);
+       ret = fclose(fp);
+       if (ret < 0) {
+               PERROR("close config read session name");
+       }
 
 error:
        return NULL;
 
 found:
-       fclose(fp);
+       ret = fclose(fp);
+       if (ret < 0) {
+               PERROR("close config read session name found");
+       }
        return session_name;
 
 }
@@ -240,14 +247,16 @@ found:
 int config_add_session_name(char *path, char *name)
 {
        int ret;
-       char session_name[NAME_MAX];
+       char *attr = "session=";
+       /* Max name len accepted plus attribute's len and the NULL byte. */
+       char session_name[NAME_MAX + strlen(attr) + 1];
 
        /*
         * With GNU C <  2.1, snprintf returns -1 if the target buffer is too small;
         * With GNU C >= 2.1, snprintf returns the required size (excluding closing null)
         */
-       ret = snprintf(session_name, NAME_MAX, "session=%s\n", name);
-       if ((ret < 0) || (ret >= NAME_MAX)) {
+       ret = snprintf(session_name, sizeof(session_name), "%s%s\n", attr, name);
+       if (ret < 0) {
                ret = -1;
                goto error;
        }
@@ -266,7 +275,7 @@ int config_init(char *session_name)
        int ret;
        char *path;
 
-       path = config_get_default_path();
+       path = utils_get_home_dir();
        if (path == NULL) {
                ret = -1;
                goto error;