Fix: unchecked buffer size for communication header

[lttng-tools.git] / src / common / payload-view.c

diff --git a/src/common/payload-view.c b/src/common/payload-view.c
index 8c99c56efa5d9d122c8fb6571e887cf3c74469cd..247ecec0ae46da86d29ea6b5587a43aa460e0d03 100644 (file)
--- a/src/common/payload-view.c
+++ b/src/common/payload-view.c
@@ -11,16 +11,22 @@
 #include "payload.h"
 #include <stddef.h>
 
+LTTNG_HIDDEN
+bool lttng_payload_view_is_valid(const struct lttng_payload_view *view)
+{
+       return view && lttng_buffer_view_is_valid(&view->buffer);
+}
+
 LTTNG_HIDDEN
 struct lttng_payload_view lttng_payload_view_from_payload(
                const struct lttng_payload *payload, size_t offset,
                ptrdiff_t len)
 {
-       return (struct lttng_payload_view) {
+       return payload ? (struct lttng_payload_view) {
                .buffer = lttng_buffer_view_from_dynamic_buffer(
                        &payload->buffer, offset, len),
-               ._fds = payload->_fds,
-       };
+               ._fd_handles = payload->_fd_handles,
+               } : (struct lttng_payload_view) {};
 }
 
 LTTNG_HIDDEN
@@ -28,13 +34,13 @@ struct lttng_payload_view lttng_payload_view_from_view(
                struct lttng_payload_view *view, size_t offset,
                ptrdiff_t len)
 {
-       return (struct lttng_payload_view) {
+       return view ? (struct lttng_payload_view) {
                .buffer = lttng_buffer_view_from_view(
                                &view->buffer, offset, len),
-               ._fds = view->_fds,
-               ._iterator.p_fds_position = view->_iterator.p_fds_position ?:
-                               &view->_iterator.fds_position,
-       };
+               ._fd_handles = view->_fd_handles,
+               ._iterator.p_fd_handles_position = view->_iterator.p_fd_handles_position ?:
+                               &view->_iterator.fd_handles_position,
+               } : (struct lttng_payload_view) {};
 }
 
 LTTNG_HIDDEN
@@ -42,10 +48,10 @@ struct lttng_payload_view lttng_payload_view_from_dynamic_buffer(
                const struct lttng_dynamic_buffer *buffer, size_t offset,
                ptrdiff_t len)
 {
-       return (struct lttng_payload_view) {
+       return buffer ? (struct lttng_payload_view) {
                .buffer = lttng_buffer_view_from_dynamic_buffer(
                        buffer, offset, len)
-       };
+               } : (struct lttng_payload_view) {};
 }
 
 LTTNG_HIDDEN
@@ -53,10 +59,10 @@ struct lttng_payload_view lttng_payload_view_from_buffer_view(
                const struct lttng_buffer_view *view, size_t offset,
                ptrdiff_t len)
 {
-       return (struct lttng_payload_view) {
+       return view ? (struct lttng_payload_view) {
                .buffer = lttng_buffer_view_from_view(
                        view, offset, len)
-       };
+               } : (struct lttng_payload_view) {};
 }
 
 LTTNG_HIDDEN
@@ -70,7 +76,8 @@ struct lttng_payload_view lttng_payload_view_init_from_buffer(
 }
 
 LTTNG_HIDDEN
-int lttng_payload_view_get_fd_count(struct lttng_payload_view *payload_view)
+int lttng_payload_view_get_fd_handle_count(
+               const struct lttng_payload_view *payload_view)
 {
        int ret;
        size_t position;
@@ -80,43 +87,43 @@ int lttng_payload_view_get_fd_count(struct lttng_payload_view *payload_view)
                goto end;
        }
 
-       ret = lttng_dynamic_array_get_count(&payload_view->_fds);
+       ret = lttng_dynamic_pointer_array_get_count(&payload_view->_fd_handles);
        if (ret < 0) {
                goto end;
        }
 
-       position = payload_view->_iterator.p_fds_position ?
-                       *payload_view->_iterator.p_fds_position :
-                       payload_view->_iterator.fds_position;
+       position = payload_view->_iterator.p_fd_handles_position ?
+                       *payload_view->_iterator.p_fd_handles_position :
+                       payload_view->_iterator.fd_handles_position;
        ret = ret - (int) position;
 end:
        return ret;
 }
 
 LTTNG_HIDDEN
-int lttng_payload_view_pop_fd(struct lttng_payload_view *view)
+struct fd_handle *lttng_payload_view_pop_fd_handle(
+               struct lttng_payload_view *view)
 {
-       int ret = 0;
-       size_t fd_count;
+       struct fd_handle *handle = NULL;
+       size_t fd_handle_count;
        size_t *pos;
 
        if (!view) {
-               ret = -1;
                goto end;
        }
 
-       fd_count = lttng_dynamic_array_get_count(&view->_fds);
-       pos = view->_iterator.p_fds_position ? view->_iterator.p_fds_position :
-               &view->_iterator.fds_position;
-
-       if (*pos >= fd_count) {
-               ret = -1;
+       fd_handle_count = lttng_payload_view_get_fd_handle_count(view);
+       if (fd_handle_count == 0) {
                goto end;
        }
 
-       ret = *((int *) lttng_dynamic_array_get_element(
-                       &view->_fds, *pos));
+       pos = view->_iterator.p_fd_handles_position ?
+                       view->_iterator.p_fd_handles_position :
+                       &view->_iterator.fd_handles_position;
+       handle = lttng_dynamic_pointer_array_get_pointer(&view->_fd_handles,
+                       *pos);
        (*pos)++;
+       fd_handle_get(handle);
 end:
-       return ret;
+       return handle;
 }