Fix debug-info: prevent invalid access in the original event_context

[babeltrace.git] / plugins / lttng-utils / copy.c

diff --git a/plugins/lttng-utils/copy.c b/plugins/lttng-utils/copy.c
index 2689a703a44aa978ea560d37cbbd7bea27092fed..482f372ad2e7208099d3d520b3a65e9dbac2bc55 100644 (file)
--- a/plugins/lttng-utils/copy.c
+++ b/plugins/lttng-utils/copy.c
@@ -84,8 +84,6 @@ struct bt_ctf_field *get_stream_event_context_field(FILE *err,
 
        sec = bt_ctf_event_get_stream_event_context(event);
        if (!sec) {
-               fprintf(err, "[error] %s in %s:%d\n", __func__,
-                               __FILE__, __LINE__);
                goto end;
        }
 
@@ -121,8 +119,6 @@ int get_stream_event_context_unsigned_int_field_value(FILE *err,
 
        field = get_stream_event_context_field(err, event, field_name);
        if (!field) {
-               fprintf(err, "[error] %s in %s:%d\n", __func__,
-                               __FILE__, __LINE__);
                goto error;
        }
 
@@ -1055,10 +1051,9 @@ struct bt_ctf_packet *debug_info_new_packet(
                                __func__, __FILE__, __LINE__);
                goto error;
        }
-       bt_get(writer_packet);
 
        writer_packet_context = ctf_copy_packet_context(debug_it->err, packet,
-                       writer_stream);
+                       writer_stream, 0);
        if (!writer_packet_context) {
                fprintf(debug_it->err, "[error] %s in %s:%d\n",
                                __func__, __FILE__, __LINE__);
@@ -1113,6 +1108,7 @@ struct bt_ctf_stream *debug_info_stream_end(struct debug_info_iterator *debug_it
                                __func__, __FILE__, __LINE__);
                goto end;
        }
+       bt_get(writer_stream);
        g_hash_table_remove(debug_it->stream_map, stream);
 
 end:
@@ -1153,7 +1149,7 @@ int set_debug_info_field(FILE *err, struct bt_ctf_field *debug_field,
                struct debug_info_source *dbg_info_src,
                struct debug_info_component *component)
 {
-       int i, nr_fields, ret;
+       int i, nr_fields, ret = 0;
        struct bt_ctf_field_type *debug_field_type = NULL;
        struct bt_ctf_field *field = NULL;
        struct bt_ctf_field_type *field_type = NULL;
@@ -1249,7 +1245,8 @@ int copy_set_debug_info_stream_event_context(FILE *err,
                struct debug_info *debug_info,
                struct debug_info_component *component)
 {
-       struct bt_ctf_field_type *writer_event_context_type = NULL;
+       struct bt_ctf_field_type *writer_event_context_type = NULL,
+                                *event_context_type = NULL;
        struct bt_ctf_field *writer_event_context = NULL;
        struct bt_ctf_field *field = NULL, *copy_field = NULL, *debug_field = NULL;
        struct bt_ctf_field_type *field_type = NULL;
@@ -1269,6 +1266,13 @@ int copy_set_debug_info_stream_event_context(FILE *err,
                goto error;
        }
 
+       event_context_type = bt_ctf_field_get_type(event_context);
+       if (!event_context_type) {
+               fprintf(err, "[error] %s in %s:%d\n", __func__,
+                               __FILE__, __LINE__);
+               goto error;
+       }
+
        /*
         * If it is not a structure, we did not modify it to add the debug info
         * fields, so just assign it as is.
@@ -1291,12 +1295,15 @@ int copy_set_debug_info_stream_event_context(FILE *err,
                        goto error;
                }
 
-               field = bt_ctf_field_structure_get_field_by_index(event_context, i);
+               /*
+                * Prevent illegal access in the event_context.
+                */
+               if (i < bt_ctf_field_type_structure_get_field_count(event_context_type)) {
+                       field = bt_ctf_field_structure_get_field_by_index(event_context, i);
+               }
                /*
                 * The debug_info field, only exists in the writer event or
                 * if it was set by a earlier pass of the debug_info plugin.
-                *
-                * FIXME: are we replacing an exisiting debug_info struct here ??
                 */
                if (!strcmp(field_name, component->arg_debug_info_field_name) &&
                                !field) {
@@ -1342,6 +1349,7 @@ int copy_set_debug_info_stream_event_context(FILE *err,
 error:
        ret = -1;
 end:
+       bt_put(event_context_type);
        bt_put(writer_event_context_type);
        bt_put(writer_event_context);
        bt_put(field);
@@ -1474,21 +1482,18 @@ struct bt_ctf_event *debug_info_copy_event(FILE *err, struct bt_ctf_event *event
                goto error;
        }
 
+       /* Optional field, so it can fail silently. */
        field = bt_ctf_event_get_header(event);
-       if (!field) {
-               fprintf(err, "[error] %s in %s:%d\n", __func__,
-                               __FILE__, __LINE__);
-               goto error;
-       }
-
-       ret = ctf_copy_event_header(err, event, writer_event_class,
-                       writer_event, field);
-       if (ret) {
-               fprintf(err, "[error] %s in %s:%d\n", __func__,
-                               __FILE__, __LINE__);
-               goto error;
+       if (field) {
+               ret = ctf_copy_event_header(err, event, writer_event_class,
+                               writer_event, field);
+               if (ret) {
+                       fprintf(err, "[error] %s in %s:%d\n", __func__,
+                                       __FILE__, __LINE__);
+                       goto error;
+               }
+               BT_PUT(field);
        }
-       BT_PUT(field);
 
        /* Optional field, so it can fail silently. */
        field = bt_ctf_event_get_stream_event_context(event);
@@ -1506,8 +1511,13 @@ struct bt_ctf_event *debug_info_copy_event(FILE *err, struct bt_ctf_event *event
 
        /* Optional field, so it can fail silently. */
        field = bt_ctf_event_get_event_context(event);
-       copy_field = bt_ctf_field_copy(field);
-       if (copy_field) {
+       if (field) {
+               copy_field = bt_ctf_field_copy(field);
+               if (!copy_field) {
+                       fprintf(err, "[error] %s in %s:%d\n", __func__,
+                                       __FILE__, __LINE__);
+                       goto error;
+               }
                ret = bt_ctf_event_set_event_context(writer_event, copy_field);
                if (ret < 0) {
                        fprintf(err, "[error] %s in %s:%d\n", __func__,
@@ -1515,8 +1525,8 @@ struct bt_ctf_event *debug_info_copy_event(FILE *err, struct bt_ctf_event *event
                        goto error;
                }
                BT_PUT(copy_field);
+               BT_PUT(field);
        }
-       BT_PUT(field);
 
        field = bt_ctf_event_get_event_payload(event);
        if (!field) {