Fix: lttng-live: use-after-free in get_next_index()

[babeltrace.git] / formats / lttng-live / lttng-live-comm.c

diff --git a/formats/lttng-live/lttng-live-comm.c b/formats/lttng-live/lttng-live-comm.c
index 055b1c30e5b321981d3e1fa3072429d545cae8b6..96817f5e170d65e02d310d0e9abc0bc224283c9f 100644 (file)
--- a/formats/lttng-live/lttng-live-comm.c
+++ b/formats/lttng-live/lttng-live-comm.c
@@ -390,6 +390,7 @@ int lttng_live_ctf_trace_assign(struct lttng_live_viewer_stream *stream,
        if (!trace) {
                trace = g_new0(struct lttng_live_ctf_trace, 1);
                trace->ctf_trace_id = ctf_trace_id;
+               trace->trace_id = -1;
                printf_verbose("Create trace ctf_trace_id %" PRIu64 "\n", ctf_trace_id);
                BT_INIT_LIST_HEAD(&trace->stream_list);
                g_hash_table_insert(stream->session->ctf_traces,
@@ -1107,8 +1108,8 @@ retry:
                viewer_stream->in_trace = 0;
                bt_list_del(&viewer_stream->trace_stream_node);
                bt_list_del(&viewer_stream->session_stream_node);
-               g_free(viewer_stream);
                *stream_id = be64toh(rp->stream_id);
+               g_free(viewer_stream);
                break;
        case LTTNG_VIEWER_INDEX_ERR:
                fprintf(stderr, "[error] get_next_index: error\n");
@@ -1466,7 +1467,7 @@ int del_traces(gpointer key, gpointer value, gpointer user_data)
                lvstream->in_trace = 0;
                bt_list_del(&lvstream->trace_stream_node);
        }
-       if (trace->in_use) {
+       if (trace->in_use && trace->trace_id >= 0) {
                ret = bt_context_remove_trace(bt_ctx, trace->trace_id);
                if (ret < 0)
                        fprintf(stderr, "[error] removing trace from context\n");
@@ -1666,7 +1667,6 @@ retry:
                 */
                if (g_hash_table_size(ctx->session->ctf_traces) != nr_traces) {
                        printf_verbose("New trace(s) added during add_one_trace()\n");
-                       printf_verbose("JORAJ: GREP HERE\n");
                        goto retry;
                }
        }