Fix: unchecked buffer size for communication header

[lttng-tools.git] / src / common / tracker.c

diff --git a/src/common/tracker.c b/src/common/tracker.c
index 0f69c775b75f6d1c08e213fa547bcbbf5feb7daa..1c50d9d7911b8fcd2a410f55893b48669f48640a 100644 (file)
--- a/src/common/tracker.c
+++ b/src/common/tracker.c
@@ -103,10 +103,12 @@ enum lttng_error_code process_attr_value_from_comm(
        }
 
        /* Only expect a payload for name value types. */
-       if (is_value_type_name(value_type) && value_view->size == 0) {
+       if (is_value_type_name(value_type) &&
+                       (!value_view || value_view->size == 0)) {
                ret = LTTNG_ERR_INVALID_PROTOCOL;
                goto error;
-       } else if (!is_value_type_name(value_type) && value_view->size != 0) {
+       } else if (!is_value_type_name(value_type) && value_view &&
+                       value_view->size != 0) {
                ret = LTTNG_ERR_INVALID_PROTOCOL;
                goto error;
        }
@@ -343,9 +345,10 @@ ssize_t lttng_process_attr_values_create_from_buffer(
 
        header_view = lttng_buffer_view_from_view(
                        buffer_view, 0, sizeof(*header));
-       if (!header_view.data) {
+       if (!lttng_buffer_view_is_valid(&header_view)) {
                goto error;
        }
+
        offset = header_view.size;
        header = (typeof(header)) header_view.data;
 
@@ -368,7 +371,7 @@ ssize_t lttng_process_attr_values_create_from_buffer(
 
                value_view = lttng_buffer_view_from_view(
                                buffer_view, offset, sizeof(*value_comm));
-               if (!value_view.data) {
+               if (!lttng_buffer_view_is_valid(&value_view)) {
                        goto error;
                }
 
@@ -380,8 +383,13 @@ ssize_t lttng_process_attr_values_create_from_buffer(
                        value_name_view = lttng_buffer_view_from_view(
                                        buffer_view, offset,
                                        value_comm->value.name_len);
+                       if (!lttng_buffer_view_is_valid(&value_name_view)) {
+                               goto error;
+                       }
+
                        offset += value_name_view.size;
                }
+
                ret_code = process_attr_value_from_comm(domain, process_attr,
                                type, &value_comm->value.integral,
                                &value_name_view, &value);