Fix: unchecked buffer size for communication header
[lttng-tools.git] / src / common / notification.c
index 785af6816f4453e5ed2b06e5845f3eea1f5e4e6c..c347b3ceac891b60ffc2ecb6a98df84653b857f5 100644 (file)
@@ -1,18 +1,8 @@
 /*
- * Copyright (C) 2017 Jérémie Galarneau <jeremie.galarneau@efficios.com>
+ * Copyright (C) 2017 Jérémie Galarneau <jeremie.galarneau@efficios.com>
  *
- * This library is free software; you can redistribute it and/or modify it
- * under the terms of the GNU Lesser General Public License, version 2.1 only,
- * as published by the Free Software Foundation.
+ * SPDX-License-Identifier: LGPL-2.1-only
  *
- * This library is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
- * for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this library; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
 #include <lttng/notification/notification-internal.h>
@@ -20,6 +10,8 @@
 #include <lttng/condition/evaluation-internal.h>
 #include <lttng/condition/condition.h>
 #include <lttng/condition/evaluation.h>
+#include <common/payload.h>
+#include <common/payload-view.h>
 #include <assert.h>
 
 LTTNG_HIDDEN
@@ -40,92 +32,104 @@ struct lttng_notification *lttng_notification_create(
 
        notification->condition = condition;
        notification->evaluation = evaluation;
-       notification->owns_elements = false;
 end:
        return notification;
 }
 
 LTTNG_HIDDEN
-ssize_t lttng_notification_serialize(struct lttng_notification *notification,
-               char *buf)
+int lttng_notification_serialize(const struct lttng_notification *notification,
+               struct lttng_payload *payload)
 {
-       ssize_t ret, condition_size, evaluation_size, offset = 0;
+       int ret;
+       size_t header_offset, size_before_payload;
        struct lttng_notification_comm notification_comm = { 0 };
+       struct lttng_notification_comm *header;
 
-       if (!notification) {
-               ret = -1;
+       header_offset = payload->buffer.size;
+       ret = lttng_dynamic_buffer_append(&payload->buffer, &notification_comm,
+                       sizeof(notification_comm));
+       if (ret) {
                goto end;
        }
 
-       offset += sizeof(notification_comm);
-       condition_size = lttng_condition_serialize(notification->condition,
-                       buf ? (buf + offset) : NULL);
-       if (condition_size < 0) {
-               ret = condition_size;
+       size_before_payload = payload->buffer.size;
+       ret = lttng_condition_serialize(notification->condition,
+                       payload);
+       if (ret) {
                goto end;
        }
-       offset += condition_size;
 
-       evaluation_size = lttng_evaluation_serialize(notification->evaluation,
-                       buf ? (buf + offset) : NULL);
-       if (evaluation_size < 0) {
-               ret = evaluation_size;
+       ret = lttng_evaluation_serialize(notification->evaluation, payload);
+       if (ret) {
                goto end;
        }
-       offset += evaluation_size;
 
-       if (buf) {
-               notification_comm.length =
-                               (uint32_t) (condition_size + evaluation_size);
-               memcpy(buf, &notification_comm, sizeof(notification_comm));
-       }
-       ret = offset;
+       /* Update payload size. */
+       header = (typeof(header)) (payload->buffer.data + header_offset);
+       header->length = (uint32_t) (payload->buffer.size - size_before_payload);
 end:
        return ret;
 
 }
 
 LTTNG_HIDDEN
-ssize_t lttng_notification_create_from_buffer(
-               const struct lttng_buffer_view *src_view,
+ssize_t lttng_notification_create_from_payload(
+               struct lttng_payload_view *src_view,
                struct lttng_notification **notification)
 {
        ssize_t ret, notification_size = 0, condition_size, evaluation_size;
-       const struct lttng_notification_comm *notification_comm;
        struct lttng_condition *condition;
        struct lttng_evaluation *evaluation;
-       struct lttng_buffer_view condition_view;
-       struct lttng_buffer_view evaluation_view;
+       const struct lttng_notification_comm *notification_comm;
+       const struct lttng_payload_view notification_comm_view =
+                       lttng_payload_view_from_view(
+                                       src_view, 0, sizeof(*notification_comm));
 
        if (!src_view || !notification) {
                ret = -1;
                goto end;
        }
 
-       notification_comm =
-                       (const struct lttng_notification_comm *) src_view->data;
+       if (!lttng_payload_view_is_valid(&notification_comm_view)) {
+               /* Payload not large enough to contain the header. */
+               ret = -1;
+               goto end;
+       }
+
+       notification_comm = (typeof(notification_comm)) notification_comm_view.buffer.data;
        notification_size += sizeof(*notification_comm);
+       {
+               /* struct lttng_condition */
+               struct lttng_payload_view condition_view =
+                               lttng_payload_view_from_view(src_view,
+                                               notification_size, -1);
+
+               condition_size = lttng_condition_create_from_payload(
+                               &condition_view, &condition);
+       }
 
-       /* struct lttng_condition */
-       condition_view = lttng_buffer_view_from_view(src_view,
-                       sizeof(*notification_comm), -1);
-       condition_size = lttng_condition_create_from_buffer(&condition_view,
-                       &condition);
        if (condition_size < 0) {
                ret = condition_size;
                goto end;
        }
+
        notification_size += condition_size;
 
-       /* struct lttng_evaluation */
-       evaluation_view = lttng_buffer_view_from_view(&condition_view,
-                       condition_size, -1);
-       evaluation_size = lttng_evaluation_create_from_buffer(&evaluation_view,
-                       &evaluation);
+       {
+               /* struct lttng_evaluation */
+               struct lttng_payload_view evaluation_view =
+                               lttng_payload_view_from_view(src_view,
+                                               notification_size, -1);
+
+               evaluation_size = lttng_evaluation_create_from_payload(
+                               &evaluation_view, &evaluation);
+       }
+
        if (evaluation_size < 0) {
                ret = evaluation_size;
                goto end;
        }
+
        notification_size += evaluation_size;
 
        /* Unexpected size of inner-elements; the buffer is corrupted. */
@@ -141,7 +145,6 @@ ssize_t lttng_notification_create_from_buffer(
                goto error;
        }
        ret = notification_size;
-       (*notification)->owns_elements = true;
 end:
        return ret;
 error:
@@ -156,10 +159,8 @@ void lttng_notification_destroy(struct lttng_notification *notification)
                return;
        }
 
-       if (notification->owns_elements) {
-               lttng_condition_destroy(notification->condition);
-               lttng_evaluation_destroy(notification->evaluation);
-       }
+       lttng_condition_destroy(notification->condition);
+       lttng_evaluation_destroy(notification->evaluation);
        free(notification);
 }
 
This page took 0.024985 seconds and 4 git commands to generate.