Fix: lttng-live: use-after-free in get_next_index()

[babeltrace.git] / formats / lttng-live / lttng-live-comm.c

diff --git a/formats/lttng-live/lttng-live-comm.c b/formats/lttng-live/lttng-live-comm.c
index e08926380efab45e306a01ec59607012f51fbc90..96817f5e170d65e02d310d0e9abc0bc224283c9f 100644 (file)
--- a/formats/lttng-live/lttng-live-comm.c
+++ b/formats/lttng-live/lttng-live-comm.c
@@ -390,6 +390,7 @@ int lttng_live_ctf_trace_assign(struct lttng_live_viewer_stream *stream,
        if (!trace) {
                trace = g_new0(struct lttng_live_ctf_trace, 1);
                trace->ctf_trace_id = ctf_trace_id;
+               trace->trace_id = -1;
                printf_verbose("Create trace ctf_trace_id %" PRIu64 "\n", ctf_trace_id);
                BT_INIT_LIST_HEAD(&trace->stream_list);
                g_hash_table_insert(stream->session->ctf_traces,
@@ -1107,8 +1108,8 @@ retry:
                viewer_stream->in_trace = 0;
                bt_list_del(&viewer_stream->trace_stream_node);
                bt_list_del(&viewer_stream->session_stream_node);
-               g_free(viewer_stream);
                *stream_id = be64toh(rp->stream_id);
+               g_free(viewer_stream);
                break;
        case LTTNG_VIEWER_INDEX_ERR:
                fprintf(stderr, "[error] get_next_index: error\n");
@@ -1223,7 +1224,8 @@ void ctf_live_packet_seek(struct bt_stream_pos *stream_pos, size_t index,
        ret = handle_seek_position(index, whence, viewer_stream, pos,
                        file_stream);
        if (ret != 0) {
-               return;
+               ret = -BT_PACKET_SEEK_ERROR;
+               goto end;
        }
 
 retry:
@@ -1265,7 +1267,8 @@ retry:
                        if (!lttng_live_should_quit()) {
                                fprintf(stderr, "[error] get_next_index failed\n");
                        }
-                       return;
+                       ret = -BT_PACKET_SEEK_ERROR;
+                       goto end;
                }
                printf_verbose("Index received : packet_size : %" PRIu64
                                ", offset %" PRIu64 ", content_size %" PRIu64
@@ -1294,7 +1297,8 @@ retry:
                file_stream->parent.stream_id = stream_id;
                viewer_stream->ctf_stream_id = stream_id;
 
-               return;
+               ret = 0;
+               goto end;
        }
 
        pos->packet_size = cur_index->packet_size;
@@ -1386,15 +1390,18 @@ retry:
                pos->offset = EOF;
                if (!lttng_live_should_quit()) {
                        fprintf(stderr, "[error] get_data_packet failed\n");
+                       ret = -BT_PACKET_SEEK_ERROR;
+               } else {
+                       ret = 0;
                }
-               return;
+               goto end;
        }
        viewer_stream->data_pending = 0;
 
        read_packet_header(pos, file_stream);
-
+       ret = 0;
 end:
-       return;
+       bt_packet_seek_set_error(ret);
 }
 
 int lttng_live_create_viewer_session(struct lttng_live_ctx *ctx)
@@ -1460,7 +1467,7 @@ int del_traces(gpointer key, gpointer value, gpointer user_data)
                lvstream->in_trace = 0;
                bt_list_del(&lvstream->trace_stream_node);
        }
-       if (trace->in_use) {
+       if (trace->in_use && trace->trace_id >= 0) {
                ret = bt_context_remove_trace(bt_ctx, trace->trace_id);
                if (ret < 0)
                        fprintf(stderr, "[error] removing trace from context\n");
@@ -1660,7 +1667,6 @@ retry:
                 */
                if (g_hash_table_size(ctx->session->ctf_traces) != nr_traces) {
                        printf_verbose("New trace(s) added during add_one_trace()\n");
-                       printf_verbose("JORAJ: GREP HERE\n");
                        goto retry;
                }
        }