Fix: test content size vs headers len

[babeltrace.git] / formats / ctf / ctf.c

diff --git a/formats/ctf/ctf.c b/formats/ctf/ctf.c
index c9eeafa5927b09edb5841ac3906bd90b4f567755..794e428c51d069a97354826b17f0f391afbafcbf 100644 (file)
--- a/formats/ctf/ctf.c
+++ b/formats/ctf/ctf.c
@@ -1489,28 +1489,28 @@ begin:
                        fprintf(stderr, "[error] Unable to read packet context: %s\n", strerror(-ret));
                        return ret;
                }
-               /* read content size from header */
-               len_index = bt_struct_declaration_lookup_field_index(file_stream->parent.stream_packet_context->declaration, g_quark_from_static_string("content_size"));
+               /* read packet size from header */
+               len_index = bt_struct_declaration_lookup_field_index(file_stream->parent.stream_packet_context->declaration, g_quark_from_static_string("packet_size"));
                if (len_index >= 0) {
                        struct bt_definition *field;
 
                        field = bt_struct_definition_get_field_from_index(file_stream->parent.stream_packet_context, len_index);
-                       packet_index.content_size = bt_get_unsigned_int(field);
+                       packet_index.packet_size = bt_get_unsigned_int(field);
                } else {
                        /* Use file size for packet size */
-                       packet_index.content_size = filesize * CHAR_BIT;
+                       packet_index.packet_size = filesize * CHAR_BIT;
                }
 
-               /* read packet size from header */
-               len_index = bt_struct_declaration_lookup_field_index(file_stream->parent.stream_packet_context->declaration, g_quark_from_static_string("packet_size"));
+               /* read content size from header */
+               len_index = bt_struct_declaration_lookup_field_index(file_stream->parent.stream_packet_context->declaration, g_quark_from_static_string("content_size"));
                if (len_index >= 0) {
                        struct bt_definition *field;
 
                        field = bt_struct_definition_get_field_from_index(file_stream->parent.stream_packet_context, len_index);
-                       packet_index.packet_size = bt_get_unsigned_int(field);
+                       packet_index.content_size = bt_get_unsigned_int(field);
                } else {
-                       /* Use content size if non-zero, else file size */
-                       packet_index.packet_size = packet_index.content_size ? : filesize * CHAR_BIT;
+                       /* Use packet size if non-zero, else file size */
+                       packet_index.content_size = packet_index.packet_size ? : filesize * CHAR_BIT;
                }
 
                /* read timestamp begin from header */
@@ -1554,9 +1554,9 @@ begin:
                }
        } else {
                /* Use file size for packet size */
-               packet_index.content_size = filesize * CHAR_BIT;
-               /* Use content size if non-zero, else file size */
-               packet_index.packet_size = packet_index.content_size ? : filesize * CHAR_BIT;
+               packet_index.packet_size = filesize * CHAR_BIT;
+               /* Use packet size if non-zero, else file size */
+               packet_index.content_size = packet_index.packet_size ? : filesize * CHAR_BIT;
        }
 
        /* Validate content size and packet size values */
@@ -1572,6 +1572,16 @@ begin:
                return -EINVAL;
        }
 
+       if (packet_index.content_size < pos->offset) {
+               fprintf(stderr, "[error] Invalid CTF stream: content size is smaller than packet headers.\n");
+               return -EINVAL;
+       }
+
+       if ((packet_index.packet_size >> LOG2_CHAR_BIT) == 0) {
+               fprintf(stderr, "[error] Invalid CTF stream: packet size needs to be at least one byte\n");
+               return -EINVAL;
+       }
+
        /* Save position after header and context */
        packet_index.data_offset = pos->offset;
 
@@ -1711,6 +1721,11 @@ int import_stream_packet_index(struct ctf_trace *td,
                ret = -1;
                goto error;
        }
+       if (index_hdr.packet_index_len == 0) {
+               fprintf(stderr, "[error] Packet index length cannot be 0.\n");
+               ret = -1;
+               goto error;
+       }
 
        while ((index_read = fread(&ctf_index, index_hdr.packet_index_len, 1,
                                        pos->index_fp)) == 1) {
@@ -1844,6 +1859,10 @@ int ctf_open_file_stream_read(struct ctf_trace *td, const char *path, int flags,
                        goto error_free;
                }
                file_stream->pos.index_fp = fdopen(ret, "r");
+               if (!file_stream->pos.index_fp) {
+                       perror("fdopen() error");
+                       goto error_free;
+               }
                ret = import_stream_packet_index(td, file_stream);
                if (ret) {
                        ret = -1;