Fix: unchecked access to pids array

[lttng-tools.git] / src / lib / lttng-ctl / lttng-ctl.c

diff --git a/src/lib/lttng-ctl/lttng-ctl.c b/src/lib/lttng-ctl/lttng-ctl.c
index 0dd12b26f3222584e2b53703a37364ce76c2dcb4..d8e2f1428df7fc27560b532c5b3c41ca478c60f8 100644 (file)
--- a/src/lib/lttng-ctl/lttng-ctl.c
+++ b/src/lib/lttng-ctl/lttng-ctl.c
@@ -1959,6 +1959,11 @@ int lttng_list_events(struct lttng_handle *handle,
                goto end;
        }
 
+       if (!cmd_header) {
+               ret = -LTTNG_ERR_UNK;
+               goto end;
+       }
+
        /* Set number of events and free command header */
        nb_events = cmd_header->nb_events;
        if (nb_events > INT_MAX) {
@@ -2034,7 +2039,6 @@ int lttng_list_events(struct lttng_handle *handle,
 
                        probe_storage_req = ret;
                        comm_ext_at += ext_comm->userspace_probe_location_len;
-                       ret = 0;
                }
 
                storage_req += sizeof(struct lttng_event_extended);
@@ -2110,6 +2114,7 @@ int lttng_list_events(struct lttng_handle *handle,
                                        ext_comm->nb_exclusions * LTTNG_SYMBOL_NAME_LEN);
                        if (ret) {
                                ret = -LTTNG_ERR_NOMEM;
+                               goto free_dynamic_buffer;
                        }
                        comm_ext_at += ext_comm->nb_exclusions * LTTNG_SYMBOL_NAME_LEN;
                }
@@ -2722,7 +2727,7 @@ int lttng_list_tracker_pids(struct lttng_handle *handle,
        int enabled = 1;
        struct lttcomm_session_msg lsm;
        size_t nr_pids;
-       int32_t *pids;
+       int32_t *pids = NULL;
 
        if (handle == NULL) {
                return -LTTNG_ERR_INVALID;
@@ -2739,6 +2744,9 @@ int lttng_list_tracker_pids(struct lttng_handle *handle,
                return ret;
        }
        nr_pids = ret / sizeof(int32_t);
+       if (nr_pids > 0 && !pids) {
+               return -LTTNG_ERR_UNK;
+       }
        if (nr_pids == 1 && pids[0] == -1) {
                free(pids);
                pids = NULL;