Fix: lttng-snapshot: use after free of max size argument

[lttng-tools.git] / src / common / lttng-elf.cpp

diff --git a/src/common/lttng-elf.cpp b/src/common/lttng-elf.cpp
index 711447203169c4d2427ce05e669f19795d3275a1..e6b8624386914a38de270fbfbb5a45808d0fe6c1 100644 (file)
--- a/src/common/lttng-elf.cpp
+++ b/src/common/lttng-elf.cpp
@@ -8,11 +8,11 @@
  */
 
 #include <algorithm>
-#include <common/compat/endian.h>
-#include <common/error.h>
-#include <common/lttng-elf.h>
-#include <common/macros.h>
-#include <common/readwrite.h>
+#include <common/compat/endian.hpp>
+#include <common/error.hpp>
+#include <common/lttng-elf.hpp>
+#include <common/macros.hpp>
+#include <common/readwrite.hpp>
 #include <fcntl.h>
 #include <stdbool.h>
 #include <stdint.h>
@@ -146,6 +146,7 @@
 #define EV_NUM 2
 #endif
 
+namespace {
 struct lttng_elf_ehdr {
        uint16_t e_type;
        uint16_t e_machine;
@@ -188,6 +189,7 @@ struct lttng_elf_sym {
        uint64_t st_value;
        uint64_t st_size;
 };
+} /* namespace */
 
 struct lttng_elf {
        int fd;
@@ -394,7 +396,7 @@ end:
         * We found the length of the section name, now seek back to the
         * beginning of the name and copy it in the newly allocated buffer.
         */
-       name = (char *)zmalloc(sizeof(char) * (name_length + 1));       /* + 1 for \0 */
+       name = calloc<char>((name_length + 1)); /* + 1 for \0 */
        if (!name) {
                PERROR("Error allocating ELF section name buffer");
                goto error;
@@ -495,7 +497,7 @@ int lttng_elf_validate_and_populate(struct lttng_elf *elf)
                goto end;
        }
 
-       elf->ehdr = (lttng_elf_ehdr *) zmalloc(sizeof(struct lttng_elf_ehdr));
+       elf->ehdr = zmalloc<lttng_elf_ehdr>();
        if (!elf->ehdr) {
                PERROR("Error allocation buffer for ELF header");
                ret = LTTNG_ERR_NOMEM;
@@ -548,7 +550,7 @@ struct lttng_elf *lttng_elf_create(int fd)
                goto error;
        }
 
-       elf = (lttng_elf *) zmalloc(sizeof(struct lttng_elf));
+       elf = zmalloc<lttng_elf>();
        if (!elf) {
                PERROR("Error allocating struct lttng_elf");
                goto error;
@@ -664,7 +666,7 @@ char *lttng_elf_get_section_data(struct lttng_elf *elf,
                                max_alloc_size);
                goto error;
        }
-       data = (char *) zmalloc(shdr->sh_size);
+       data = calloc<char>(shdr->sh_size);
        if (!data) {
                PERROR("Error allocating buffer for ELF section data");
                goto error;
@@ -827,7 +829,7 @@ int lttng_elf_get_symbol_offset(int fd, char *symbol, uint64_t *offset)
        if (symtab_hdr.sh_entsize == 0) {
                DBG("Invalid ELF string table entry size.");
                ret = LTTNG_ERR_ELF_PARSING;
-               goto free_symbol_table_data;
+               goto free_string_table_data;
        }
 
        sym_count = symtab_hdr.sh_size / symtab_hdr.sh_entsize;