From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Date: Tue, 17 May 2016 01:42:49 +0000 (-0400)
Subject: Fix: illegal memory access in output_init
X-Git-Tag: v2.9.0-rc1~224
X-Git-Url: https://git.lttng.org/?p=lttng-tools.git;a=commitdiff_plain;h=35f3ec96c16ac479b03ce789c725e74368020cbf

Fix: illegal memory access in output_init

Found by Coverity:

CID 1243028 (#1 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)5. buffer_size_warning: Calling strncpy with a
maximum size argument of 255 bytes on destination array output->name of
size 255 bytes might leave the destination string unterminated.

CID 1243028 (#2 of 2): Buffer not null terminated
(BUFFER_SIZE_WARNING)10. buffer_size_warning: Calling strncpy with a
maximum size argument of 4096 bytes on destination array
output->consumer->dst.trace_path of size 4096 bytes might leave the
destination string unterminated.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
---

diff --git a/src/bin/lttng-sessiond/snapshot.c b/src/bin/lttng-sessiond/snapshot.c
index 3de468a83..d2016a165 100644
--- a/src/bin/lttng-sessiond/snapshot.c
+++ b/src/bin/lttng-sessiond/snapshot.c
@@ -62,7 +62,10 @@ static int output_init(uint64_t max_size, const char *name,
 	lttng_ht_node_init_ulong(&output->node, (unsigned long) output->id);
 
 	if (name && name[0] != '\0') {
-		strncpy(output->name, name, sizeof(output->name));
+		if (lttng_strncpy(output->name, name, sizeof(output->name))) {
+			ret = -LTTNG_ERR_INVALID;
+			goto error;
+		}
 	} else {
 		/* Set default name. */
 		ret = snprintf(output->name, sizeof(output->name), "%s-%" PRIu32,
@@ -93,8 +96,12 @@ static int output_init(uint64_t max_size, const char *name,
 	if (uris[0].dtype == LTTNG_DST_PATH) {
 		memset(output->consumer->dst.trace_path, 0,
 				sizeof(output->consumer->dst.trace_path));
-		strncpy(output->consumer->dst.trace_path, uris[0].dst.path,
-				sizeof(output->consumer->dst.trace_path));
+		if (lttng_strncpy(output->consumer->dst.trace_path,
+				uris[0].dst.path,
+				sizeof(output->consumer->dst.trace_path))) {
+			ret = -LTTNG_ERR_INVALID;
+			goto error;
+		}
 		output->consumer->type = CONSUMER_DST_LOCAL;
 		ret = 0;
 		goto end;