Fix: unchecked buffer size for communication header

[lttng-tools.git] / src / common / userspace-probe.c

diff --git a/src/common/userspace-probe.c b/src/common/userspace-probe.c
index 9e5429f7378503029db5ff4afbf97ebc6588dc11..609ffc1ac22874cb5d944a2ced6adcc0cf07e2b2 100644 (file)
--- a/src/common/userspace-probe.c
+++ b/src/common/userspace-probe.c
@@ -1212,11 +1212,14 @@ int lttng_userspace_probe_location_function_create_from_payload(
        binary_path_src = function_name_src +
                        location_function_comm->function_name_len;
 
        binary_path_src = function_name_src +
                        location_function_comm->function_name_len;
 

-       if (function_name_src[location_function_comm->function_name_len - 1] != '\0') {
+       if (!lttng_buffer_view_contains_string(&view->buffer, function_name_src,
+                           location_function_comm->function_name_len)) {

                ret = -LTTNG_ERR_INVALID;
                goto end;
        }
                ret = -LTTNG_ERR_INVALID;
                goto end;
        }

-       if (binary_path_src[location_function_comm->binary_path_len - 1] != '\0') {
+
+       if (!lttng_buffer_view_contains_string(&view->buffer, binary_path_src,
+                           location_function_comm->binary_path_len)) {

                ret = -LTTNG_ERR_INVALID;
                goto end;
        }
                ret = -LTTNG_ERR_INVALID;
                goto end;
        }


@@ -1300,17 +1303,20 @@ int lttng_userspace_probe_location_tracepoint_create_from_payload(
        binary_path_src = provider_name_src +
                        location_tracepoint_comm->provider_name_len;
 
        binary_path_src = provider_name_src +
                        location_tracepoint_comm->provider_name_len;
 

-       if (probe_name_src[location_tracepoint_comm->probe_name_len - 1] != '\0') {
+       if (!lttng_buffer_view_contains_string(&view->buffer, probe_name_src,
+                           location_tracepoint_comm->probe_name_len)) {

                ret = -LTTNG_ERR_INVALID;
                goto end;
        }
 
                ret = -LTTNG_ERR_INVALID;
                goto end;
        }
 

-       if (provider_name_src[location_tracepoint_comm->provider_name_len - 1] != '\0') {
+       if (!lttng_buffer_view_contains_string(&view->buffer, provider_name_src,
+                           location_tracepoint_comm->provider_name_len)) {

                ret = -LTTNG_ERR_INVALID;
                goto end;
        }
 
                ret = -LTTNG_ERR_INVALID;
                goto end;
        }
 

-       if (binary_path_src[location_tracepoint_comm->binary_path_len - 1] != '\0') {
+       if (!lttng_buffer_view_contains_string(&view->buffer, binary_path_src,
+                           location_tracepoint_comm->binary_path_len)) {

                ret = -LTTNG_ERR_INVALID;
                goto end;
        }
                ret = -LTTNG_ERR_INVALID;
                goto end;
        }


@@ -1411,22 +1417,25 @@ int lttng_userspace_probe_location_create_from_payload(
                struct lttng_userspace_probe_location **location)
 {
        struct lttng_userspace_probe_location_lookup_method *lookup_method;
                struct lttng_userspace_probe_location **location)
 {
        struct lttng_userspace_probe_location_lookup_method *lookup_method;

-       struct lttng_userspace_probe_location_comm *probe_location_comm;

        enum lttng_userspace_probe_location_type type;
        int consumed = 0;
        int ret;
        enum lttng_userspace_probe_location_type type;
        int consumed = 0;
        int ret;

+       struct lttng_userspace_probe_location_comm *probe_location_comm;
+       struct lttng_payload_view probe_location_comm_view =
+                       lttng_payload_view_from_view(
+                                       view, 0, sizeof(*probe_location_comm));

 
        assert(view);
        assert(location);
 
        lookup_method = NULL;
 
 
        assert(view);
        assert(location);
 
        lookup_method = NULL;
 

-       if (view->buffer.size <= sizeof(*probe_location_comm)) {
+       if (!lttng_payload_view_is_valid(&probe_location_comm_view)) {

                ret = -LTTNG_ERR_INVALID;
                goto end;
        }
 
                ret = -LTTNG_ERR_INVALID;
                goto end;
        }
 

-       probe_location_comm = (typeof(probe_location_comm)) view->buffer.data;
+       probe_location_comm = (typeof(probe_location_comm)) probe_location_comm_view.buffer.data;

        type = (enum lttng_userspace_probe_location_type) probe_location_comm->type;
        consumed += sizeof(*probe_location_comm);
 
        type = (enum lttng_userspace_probe_location_type) probe_location_comm->type;
        consumed += sizeof(*probe_location_comm);