Fix: illegal memory access in disable_event
authorMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Tue, 17 May 2016 01:42:45 +0000 (21:42 -0400)
committerJérémie Galarneau <jeremie.galarneau@efficios.com>
Tue, 17 May 2016 04:29:44 +0000 (00:29 -0400)
Found by Coverity:
CID 1243016 (#1 of 1): Buffer not null terminated
(BUFFER_SIZE_WARNING)14. buffer_size_warning: Calling strncpy with a
maximum size argument of 256 bytes on destination array msg.name of size
256 bytes might leave the destination string unterminated.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
src/bin/lttng-sessiond/agent.c

index f79ac00e6f4c5313928d5a15bd560efbe41454d4..6841d41928660be42594fe8c6b8a0dc08cc6d300 100644 (file)
@@ -594,14 +594,17 @@ static int disable_event(struct agent_app *app, struct agent_event *event)
                        app->pid, app->sock->fd);
 
        data_size = sizeof(msg);
+       memset(&msg, 0, sizeof(msg));
+       if (lttng_strncpy(msg.name, event->name, sizeof(msg.name))) {
+               ret = LTTNG_ERR_INVALID;
+               goto error;
+       }
 
        ret = send_header(app->sock, data_size, AGENT_CMD_DISABLE, 0);
        if (ret < 0) {
                goto error_io;
        }
 
-       memset(&msg, 0, sizeof(msg));
-       strncpy(msg.name, event->name, sizeof(msg.name));
        ret = send_payload(app->sock, &msg, sizeof(msg));
        if (ret < 0) {
                goto error_io;
This page took 0.033634 seconds and 4 git commands to generate.