Fix: lttng-snapshot: use after free of max size argument

[lttng-tools.git] / src / common / runas.cpp

diff --git a/src/common/runas.cpp b/src/common/runas.cpp
index eae650ba5038b9a09ab028709adaad6f7b41dc89..2c762d5ee797f3a98c92f1f59527a1a9ae92f37c 100644 (file)
--- a/src/common/runas.cpp
+++ b/src/common/runas.cpp
@@ -22,31 +22,27 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-#include <common/bytecode/bytecode.h>
-#include <common/lttng-kernel.h>
-#include <common/common.h>
-#include <common/utils.h>
-#include <common/compat/errno.h>
-#include <common/compat/getenv.h>
-#include <common/compat/string.h>
-#include <common/unix.h>
-#include <common/defaults.h>
-#include <common/lttng-elf.h>
-#include <common/thread.h>
+#include <common/bytecode/bytecode.hpp>
+#include <common/lttng-kernel.hpp>
+#include <common/common.hpp>
+#include <common/utils.hpp>
+#include <common/compat/errno.hpp>
+#include <common/compat/getenv.hpp>
+#include <common/compat/string.hpp>
+#include <common/unix.hpp>
+#include <common/defaults.hpp>
+#include <common/lttng-elf.hpp>
+#include <common/thread.hpp>
 
 #include <lttng/constant.h>
 
-#include <common/sessiond-comm/sessiond-comm.h>
-#include <common/filter/filter-ast.h>
+#include <common/sessiond-comm/sessiond-comm.hpp>
+#include <common/filter/filter-ast.hpp>
 
-#include "runas.h"
+#include "runas.hpp"
 
 #define GETPW_BUFFER_FALLBACK_SIZE 4096
 
-struct run_as_data;
-struct run_as_ret;
-typedef int (*run_as_fct)(struct run_as_data *data, struct run_as_ret *ret_value);
-
 enum run_as_cmd {
        RUN_AS_MKDIR,
        RUN_AS_MKDIRAT,
@@ -67,6 +63,11 @@ enum run_as_cmd {
        RUN_AS_GENERATE_FILTER_BYTECODE,
 };
 
+namespace {
+struct run_as_data;
+struct run_as_ret;
+typedef int (*run_as_fct)(struct run_as_data *data, struct run_as_ret *ret_value);
+
 struct run_as_mkdir_data {
        int dirfd;
        char path[LTTNG_PATH_MAX];
@@ -210,7 +211,7 @@ struct run_as_command_properties {
        bool use_cwd_fd;
 };
 
-static const struct run_as_command_properties command_properties[] = {
+const struct run_as_command_properties command_properties[] = {
        {
                .in_fds_offset = offsetof(struct run_as_data, u.mkdir.dirfd),
                .out_fds_offset = -1,
@@ -341,9 +342,10 @@ struct run_as_worker_data {
 };
 
 /* Single global worker per process (for now). */
-static run_as_worker_data *global_worker;
+run_as_worker_data *global_worker;
 /* Lock protecting the worker. */
-static pthread_mutex_t worker_lock = PTHREAD_MUTEX_INITIALIZER;
+pthread_mutex_t worker_lock = PTHREAD_MUTEX_INITIALIZER;
+} /* namespace */
 
 #ifdef VALGRIND
 static
@@ -930,7 +932,7 @@ static int get_user_infos_from_uid(
 
        get_pw_buf_size = (size_t) raw_get_pw_buf_size;
 
-       buf = (char *) zmalloc(get_pw_buf_size);
+       buf = calloc<char>(get_pw_buf_size);
        if (buf == NULL) {
                PERROR("Failed to allocate buffer to get password file entries");
                goto error;
@@ -1458,7 +1460,7 @@ int run_as_create_worker_no_lock(const char *procname,
                ret = 0;
                goto end;
        }
-       worker = (run_as_worker_data *) zmalloc(sizeof(*worker));
+       worker = zmalloc<run_as_worker_data>();
        if (!worker) {
                ret = -ENOMEM;
                goto end;
@@ -1959,7 +1961,7 @@ int run_as_extract_sdt_probe_offsets(int fd, const char* provider_name,
        }
 
        *num_offset = run_as_ret.u.extract_sdt_probe_offsets.num_offset;
-       *offsets = (uint64_t *) zmalloc(*num_offset * sizeof(uint64_t));
+       *offsets = calloc<uint64_t>(*num_offset);
        if (!*offsets) {
                ret = -ENOMEM;
                goto error;
@@ -2001,7 +2003,7 @@ int run_as_generate_filter_bytecode(const char *filter_expression,
 
        view_bytecode = (const struct lttng_bytecode *) run_as_ret.u.generate_filter_bytecode.bytecode;
 
-       local_bytecode = (lttng_bytecode *) zmalloc(sizeof(*local_bytecode) + view_bytecode->len);
+       local_bytecode = calloc<lttng_bytecode>(view_bytecode->len);
        if (!local_bytecode) {
                ret = -ENOMEM;
                goto error;