Fix: illegal memory access in list_events

Found by Coverity:
CID 1243022 (#1 of 1): Buffer not null terminated
(BUFFER_SIZE_WARNING)23. buffer_size_warning: Calling strncpy with a
maximum size argument of 256 bytes on destination array (tmp_events +
i).name of size 256 bytes might leave the destination string
unterminated.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>

diff --git a/src/bin/lttng-sessiond/agent.c b/src/bin/lttng-sessiond/agent.c
index c9e056928e83afc66f7d6da473e78f7bc014d29c..27e7d029c9e452bccd5874239fcb68c7767f6364 100644 (file)
--- a/src/bin/lttng-sessiond/agent.c
+++ b/src/bin/lttng-sessiond/agent.c
@@ -299,8 +299,11 @@ static ssize_t list_events(struct agent_app *app, struct lttng_event **events)
 
        for (i = 0; i < nb_event; i++) {
                offset += len;
-               strncpy(tmp_events[i].name, reply->payload + offset,
-                               sizeof(tmp_events[i].name));
+               if (lttng_strncpy(tmp_events[i].name, reply->payload + offset,
+                               sizeof(tmp_events[i].name))) {
+                       ret = LTTNG_ERR_INVALID;
+                       goto error;
+               }
                tmp_events[i].pid = app->pid;
                tmp_events[i].enabled = -1;
                len = strlen(reply->payload + offset) + 1;