summary |
shortlog |
log |
commit | commitdiff |
tree
raw |
patch |
inline | side by side (from parent 1:
2855532)
Ensure that string lengths are not longer than what the protocol
supports on both send and receive. Ensure that path lengths fit in the
local filename length limits on the receive side. Ensure that strings
exchanged in the relay protocol are zero-terminated.
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
#define _LGPL_SOURCE
#include <assert.h>
#define _LGPL_SOURCE
#include <assert.h>
#include <common/common.h>
#include <common/sessiond-comm/relayd.h>
#include <common/common.h>
#include <common/sessiond-comm/relayd.h>
+#include <common/compat/string.h>
+#include <lttng/constant.h>
#include "cmd-generic.h"
#include "cmd-2-1.h"
#include "cmd-generic.h"
#include "cmd-2-1.h"
struct lttcomm_relayd_add_stream stream_info;
char *path_name = NULL;
char *channel_name = NULL;
struct lttcomm_relayd_add_stream stream_info;
char *path_name = NULL;
char *channel_name = NULL;
ret = cmd_recv(conn->sock, &stream_info, sizeof(stream_info));
if (ret < 0) {
ret = cmd_recv(conn->sock, &stream_info, sizeof(stream_info));
if (ret < 0) {
+ len = lttng_strnlen(stream_info.pathname, sizeof(stream_info.pathname));
+ /* Ensure that NULL-terminated and fits in local filename length. */
+ if (len == sizeof(stream_info.pathname) || len >= LTTNG_NAME_MAX) {
+ ret = -ENAMETOOLONG;
+ ERR("Path name too long");
+ goto error;
+ }
path_name = create_output_path(stream_info.pathname);
if (!path_name) {
PERROR("Path name allocation");
ret = -ENOMEM;
goto error;
}
path_name = create_output_path(stream_info.pathname);
if (!path_name) {
PERROR("Path name allocation");
ret = -ENOMEM;
goto error;
}
+ len = lttng_strnlen(stream_info.channel_name, sizeof(stream_info.channel_name));
+ if (len == sizeof(stream_info.channel_name) || len >= DEFAULT_STREAM_NAME_LEN) {
+ ret = -ENAMETOOLONG;
+ ERR("Channel name too long");
+ goto error;
+ }
channel_name = strdup(stream_info.channel_name);
if (!channel_name) {
ret = -errno;
channel_name = strdup(stream_info.channel_name);
if (!channel_name) {
ret = -errno;
- PERROR("Path name allocation");
+ PERROR("Channel name allocation");
#define _LGPL_SOURCE
#include <assert.h>
#define _LGPL_SOURCE
#include <assert.h>
#include <common/common.h>
#include <common/sessiond-comm/relayd.h>
#include <common/compat/endian.h>
#include <common/common.h>
#include <common/sessiond-comm/relayd.h>
#include <common/compat/endian.h>
+#include <common/compat/string.h>
+#include <lttng/constant.h>
#include "cmd-generic.h"
#include "cmd-2-1.h"
#include "cmd-generic.h"
#include "cmd-2-1.h"
struct lttcomm_relayd_add_stream_2_2 stream_info;
char *path_name = NULL;
char *channel_name = NULL;
struct lttcomm_relayd_add_stream_2_2 stream_info;
char *path_name = NULL;
char *channel_name = NULL;
ret = cmd_recv(conn->sock, &stream_info, sizeof(stream_info));
if (ret < 0) {
ret = cmd_recv(conn->sock, &stream_info, sizeof(stream_info));
if (ret < 0) {
+ len = lttng_strnlen(stream_info.pathname, sizeof(stream_info.pathname));
+ /* Ensure that NULL-terminated and fits in local filename length. */
+ if (len == sizeof(stream_info.pathname) || len >= LTTNG_NAME_MAX) {
+ ret = -ENAMETOOLONG;
+ ERR("Path name too long");
+ goto error;
+ }
path_name = create_output_path(stream_info.pathname);
if (!path_name) {
PERROR("Path name allocation");
ret = -ENOMEM;
goto error;
}
path_name = create_output_path(stream_info.pathname);
if (!path_name) {
PERROR("Path name allocation");
ret = -ENOMEM;
goto error;
}
+ len = lttng_strnlen(stream_info.channel_name, sizeof(stream_info.channel_name));
+ if (len == sizeof(stream_info.channel_name) || len >= DEFAULT_STREAM_NAME_LEN) {
+ ret = -ENAMETOOLONG;
+ ERR("Channel name too long");
+ goto error;
+ }
channel_name = strdup(stream_info.channel_name);
if (!channel_name) {
ret = -errno;
channel_name = strdup(stream_info.channel_name);
if (!channel_name) {
ret = -errno;
- PERROR("Path name allocation");
+ PERROR("Channel name allocation");
#define _LGPL_SOURCE
#include <assert.h>
#define _LGPL_SOURCE
#include <assert.h>
#include <common/common.h>
#include <common/sessiond-comm/relayd.h>
#include <common/compat/endian.h>
#include <common/common.h>
#include <common/sessiond-comm/relayd.h>
#include <common/compat/endian.h>
+#include <common/compat/string.h>
+#include <lttng/constant.h>
#include "cmd-generic.h"
#include "lttng-relayd.h"
#include "cmd-generic.h"
#include "lttng-relayd.h"
{
int ret;
struct lttcomm_relayd_create_session_2_4 session_info;
{
int ret;
struct lttcomm_relayd_create_session_2_4 session_info;
ret = cmd_recv(conn->sock, &session_info, sizeof(session_info));
if (ret < 0) {
ERR("Unable to recv session info version 2.4");
goto error;
}
ret = cmd_recv(conn->sock, &session_info, sizeof(session_info));
if (ret < 0) {
ERR("Unable to recv session info version 2.4");
goto error;
}
+ len = lttng_strnlen(session_info.session_name, sizeof(session_info.session_name));
+ /* Ensure that NULL-terminated and fits in local filename length. */
+ if (len == sizeof(session_info.session_name) || len >= LTTNG_NAME_MAX) {
+ ret = -ENAMETOOLONG;
+ ERR("Session name too long");
+ goto error;
+ }
strncpy(session_name, session_info.session_name,
sizeof(session_info.session_name));
strncpy(session_name, session_info.session_name,
sizeof(session_info.session_name));
+
+ len = lttng_strnlen(session_info.hostname, sizeof(session_info.hostname));
+ if (len == sizeof(session_info.hostname) || len >= LTTNG_HOST_NAME_MAX) {
+ ret = -ENAMETOOLONG;
+ ERR("Session name too long");
+ goto error;
+ }
strncpy(hostname, session_info.hostname,
sizeof(session_info.hostname));
*live_timer = be32toh(session_info.live_timer);
strncpy(hostname, session_info.hostname,
sizeof(session_info.hostname));
*live_timer = be32toh(session_info.live_timer);
int ret;
struct lttcomm_relayd_create_session_2_4 msg;
int ret;
struct lttcomm_relayd_create_session_2_4 msg;
+ if (strlen(session_name) >= sizeof(msg.session_name)) {
+ ret = -1;
+ goto error;
+ }
strncpy(msg.session_name, session_name, sizeof(msg.session_name));
strncpy(msg.session_name, session_name, sizeof(msg.session_name));
+ if (strlen(hostname) >= sizeof(msg.hostname)) {
+ ret = -1;
+ goto error;
+ }
strncpy(msg.hostname, hostname, sizeof(msg.hostname));
msg.live_timer = htobe32(session_live_timer);
msg.snapshot = htobe32(snapshot);
strncpy(msg.hostname, hostname, sizeof(msg.hostname));
msg.live_timer = htobe32(session_live_timer);
msg.snapshot = htobe32(snapshot);
/* Compat with relayd 2.1 */
if (rsock->minor == 1) {
memset(&msg, 0, sizeof(msg));
/* Compat with relayd 2.1 */
if (rsock->minor == 1) {
memset(&msg, 0, sizeof(msg));
+ if (strlen(channel_name) >= sizeof(msg.channel_name)) {
+ ret = -1;
+ goto error;
+ }
strncpy(msg.channel_name, channel_name, sizeof(msg.channel_name));
strncpy(msg.channel_name, channel_name, sizeof(msg.channel_name));
+ if (strlen(pathname) >= sizeof(msg.pathname)) {
+ ret = -1;
+ goto error;
+ }
strncpy(msg.pathname, pathname, sizeof(msg.pathname));
/* Send command */
strncpy(msg.pathname, pathname, sizeof(msg.pathname));
/* Send command */
} else {
memset(&msg_2_2, 0, sizeof(msg_2_2));
/* Compat with relayd 2.2+ */
} else {
memset(&msg_2_2, 0, sizeof(msg_2_2));
/* Compat with relayd 2.2+ */
+ if (strlen(channel_name) >= sizeof(msg_2_2.channel_name)) {
+ ret = -1;
+ goto error;
+ }
strncpy(msg_2_2.channel_name, channel_name, sizeof(msg_2_2.channel_name));
strncpy(msg_2_2.channel_name, channel_name, sizeof(msg_2_2.channel_name));
+ if (strlen(pathname) >= sizeof(msg_2_2.pathname)) {
+ ret = -1;
+ goto error;
+ }
strncpy(msg_2_2.pathname, pathname, sizeof(msg_2_2.pathname));
msg_2_2.tracefile_size = htobe64(tracefile_size);
msg_2_2.tracefile_count = htobe64(tracefile_count);
strncpy(msg_2_2.pathname, pathname, sizeof(msg_2_2.pathname));
msg_2_2.tracefile_size = htobe64(tracefile_size);
msg_2_2.tracefile_count = htobe64(tracefile_count);