Fix: lttng-live: use-after-free in get_next_index()

[babeltrace.git] / formats / lttng-live / lttng-live-comm.c

diff --git a/formats/lttng-live/lttng-live-comm.c b/formats/lttng-live/lttng-live-comm.c
index cb871a1318113e4909ba3db8ad3ceae132ed7e05..96817f5e170d65e02d310d0e9abc0bc224283c9f 100644 (file)
--- a/formats/lttng-live/lttng-live-comm.c
+++ b/formats/lttng-live/lttng-live-comm.c
@@ -390,6 +390,7 @@ int lttng_live_ctf_trace_assign(struct lttng_live_viewer_stream *stream,
        if (!trace) {
                trace = g_new0(struct lttng_live_ctf_trace, 1);
                trace->ctf_trace_id = ctf_trace_id;
+               trace->trace_id = -1;
                printf_verbose("Create trace ctf_trace_id %" PRIu64 "\n", ctf_trace_id);
                BT_INIT_LIST_HEAD(&trace->stream_list);
                g_hash_table_insert(stream->session->ctf_traces,
@@ -1107,8 +1108,8 @@ retry:
                viewer_stream->in_trace = 0;
                bt_list_del(&viewer_stream->trace_stream_node);
                bt_list_del(&viewer_stream->session_stream_node);
-               g_free(viewer_stream);
                *stream_id = be64toh(rp->stream_id);
+               g_free(viewer_stream);
                break;
        case LTTNG_VIEWER_INDEX_ERR:
                fprintf(stderr, "[error] get_next_index: error\n");
@@ -1223,7 +1224,7 @@ void ctf_live_packet_seek(struct bt_stream_pos *stream_pos, size_t index,
        ret = handle_seek_position(index, whence, viewer_stream, pos,
                        file_stream);
        if (ret != 0) {
-               ret = -1;
+               ret = -BT_PACKET_SEEK_ERROR;
                goto end;
        }
 
@@ -1266,7 +1267,7 @@ retry:
                        if (!lttng_live_should_quit()) {
                                fprintf(stderr, "[error] get_next_index failed\n");
                        }
-                       ret = -1;
+                       ret = -BT_PACKET_SEEK_ERROR;
                        goto end;
                }
                printf_verbose("Index received : packet_size : %" PRIu64
@@ -1389,7 +1390,7 @@ retry:
                pos->offset = EOF;
                if (!lttng_live_should_quit()) {
                        fprintf(stderr, "[error] get_data_packet failed\n");
-                       ret = -1;
+                       ret = -BT_PACKET_SEEK_ERROR;
                } else {
                        ret = 0;
                }
@@ -1466,7 +1467,7 @@ int del_traces(gpointer key, gpointer value, gpointer user_data)
                lvstream->in_trace = 0;
                bt_list_del(&lvstream->trace_stream_node);
        }
-       if (trace->in_use) {
+       if (trace->in_use && trace->trace_id >= 0) {
                ret = bt_context_remove_trace(bt_ctx, trace->trace_id);
                if (ret < 0)
                        fprintf(stderr, "[error] removing trace from context\n");
@@ -1666,7 +1667,6 @@ retry:
                 */
                if (g_hash_table_size(ctx->session->ctf_traces) != nr_traces) {
                        printf_verbose("New trace(s) added during add_one_trace()\n");
-                       printf_verbose("JORAJ: GREP HERE\n");
                        goto retry;
                }
        }