Fix: event-expr.c: use-after-free and NULL ptr deref in error path
authorFrancis Deslauriers <francis.deslauriers@efficios.com>
Thu, 22 Apr 2021 22:50:57 +0000 (18:50 -0400)
committerJérémie Galarneau <jeremie.galarneau@efficios.com>
Fri, 23 Apr 2021 15:30:02 +0000 (11:30 -0400)
commit5b5ad96e89dad760c8254d47776efedf69c9ecc8
tree6d27e4bca54ee7d94fd624230b081a05e0712ba0
parentb623cb6a788d9e666d9a93658ab04b06458863ef
Fix: event-expr.c: use-after-free and NULL ptr deref in error path

use-after-free
==============
The following functions are affected:
  `lttng_event_expr_app_specific_context_field_create()`, and
  `lttng_event_expr_array_field_element_create()`.

In one error path we call `lttng_event_expr_destroy()` with the
`&expr->parent` pointer (which is dynamically allocated) and this
function then calls free() on that pointer. Right after that function
call we return the pointer that was just freed.

Fix that by adding a `ret_parent_expr` pointer that is set to NULL on
the error path;

Null pointer dereference
========================
The following functions are affected:
  `lttng_event_expr_app_specific_context_field_create()`,
  `lttng_event_expr_array_field_element_create()`, and
  `create_field_event_expr()`.

We dereference a NULL pointer if the argument sanity check fails.

Fix that by checking if `expr` is non-null before dereferencing it.

Found with scan-build.

Signed-off-by: Francis Deslauriers <francis.deslauriers@efficios.com>
Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
Change-Id: I5fdde462d7345d0dae7ecd2e4f46473a92cd11a9
src/lib/lttng-ctl/event-expr.c
This page took 0.025175 seconds and 4 git commands to generate.