Fix: src.ctf.fs: segfault following `bt_msg_iter_seek()`
authorFrancis Deslauriers <francis.deslauriers@efficios.com>
Tue, 25 Jun 2019 15:01:30 +0000 (11:01 -0400)
committerPhilippe Proulx <eeppeliteloop@gmail.com>
Fri, 5 Jul 2019 18:36:25 +0000 (14:36 -0400)
commitde2abea4becff99e88036b6c18295fe256506e36
tree7b05572754f216ff5fe446abc0df6352492c058b
parentf5d6ce325cbf33abe6d63b815f0e35fd7fa7d021
Fix: src.ctf.fs: segfault following `bt_msg_iter_seek()`

Issue
=====
Seeking a `bt_msg_iter` right after its creation leaves its `mmap_addr`
field uninitialized which may lead to a segmentation fault when
`medop_request_byte()` is called.

It triggers a segfault in `medop_request_byte()` because
`ds_file->mmap_len` field is 0 and `ds_file->request_offset` field is
larger than 0. This makes the call to `remaining_mmap_bytes()` return
non-zero.

It makes it so that the call to `ds_file_mmap_next()` is skipped and
`ds_file->mmap_addr` is dereferenced without being initialized.

The real underlying issue is that `medop_seek()` returns success even
when no file is mapped.

Solution
========
When seeking, map the right file if `mmap_addr` is still uninitialized.

Drawback
========
None.

Notes
=====
I also added comments and `BT_ASSERT()` that helped me track down this
issue and that I believe could be useful for other developers.

Signed-off-by: Francis Deslauriers <francis.deslauriers@efficios.com>
Change-Id: I041dc89159953a6ffce016b8c094969fb9c3f862
Reviewed-on: https://review.lttng.org/c/babeltrace/+/1532
Reviewed-by: Philippe Proulx <eeppeliteloop@gmail.com>
CI-Build: Philippe Proulx <eeppeliteloop@gmail.com>
Tested-by: jenkins <jenkins@lttng.org>
src/plugins/ctf/fs-src/data-stream-file.c
This page took 0.02507 seconds and 4 git commands to generate.