Fix: ctf: verify that field class is int before calling ctf_field_class_as_int
authorSimon Marchi <simon.marchi@efficios.com>
Mon, 20 Feb 2023 20:40:35 +0000 (15:40 -0500)
committerPhilippe Proulx <eeppeliteloop@gmail.com>
Tue, 14 Mar 2023 18:09:54 +0000 (14:09 -0400)
commitab003dc0397a13f72c8268c310c0559a06a87fb1
treef26944e48e7e42209367f9343186d051e3410866
parent437ed44dbbb8a04e0bcb62c092b7e8b7471b98a2
Fix: ctf: verify that field class is int before calling ctf_field_class_as_int

Some code paths call ctf_field_class_as_int functions before confirming
that the field class is indeed an int (or enum, which is a sub-type of
int).  This causes assertion failures, because these functions assert
that the field class they receive have the right type.

One case can be hit using the invalid-sequence-length-field-class trace,
included with this patch:

    $ /home/smarchi/build/babeltrace/tests/../src/cli/babeltrace2 -c sink.text.details -p with-trace-name=no,with-stream-name=no /home/smarchi/src/babeltrace/tests/data/ctf-traces/fail/invalid-sequence-length-field-class

     (╯°□°)╯︵ ┻━┻  /home/smarchi/src/babeltrace/src/plugins/ctf/common/metadata/ctf-meta.hpp:355: ctf_field_class_as_int(): Assertion `!fc || (fc->type == CTF_FIELD_CLASS_TYPE_INT || fc->type == CTF_FIELD_CLASS_TYPE_ENUM)` failed.

This particular crash happens here:

    #4  0x00007ffff535de9d in bt_common_assert_failed (file=0x7ffff5374a60 "/home/smarchi/src/babeltrace/src/plugins/ctf/common/metadata/ctf-meta.hpp",
        line=355, func=0x7ffff5374a20 "ctf_field_class_as_int",
        assertion=0x7ffff53749a0 "!fc || (fc->type == CTF_FIELD_CLASS_TYPE_INT || fc->type == CTF_FIELD_CLASS_TYPE_ENUM)")
        at /home/smarchi/src/babeltrace/src/common/assert.c:40
    #5  0x00007ffff5271cca in ctf_field_class_as_int (fc=0x603000002b60) at /home/smarchi/src/babeltrace/src/plugins/ctf/common/metadata/ctf-meta.hpp:355
    #6  0x00007ffff527a54b in validate_target_field_path (target_field_path=0x7fffffffce60, target_fc=0x603000002b60, ctx=0x7fffffffd050)
        at /home/smarchi/src/babeltrace/src/plugins/ctf/common/metadata/ctf-meta-resolve.cpp:877
    #7  0x00007ffff527bb7f in resolve_sequence_or_variant_field_class (fc=0x607000000950, ctx=0x7fffffffd050)
        at /home/smarchi/src/babeltrace/src/plugins/ctf/common/metadata/ctf-meta-resolve.cpp:969

In validate_target_field_path, when handing a sequence, we call
ctf_field_class_as_int on target_fc (the length field class) before
confirming it is really an int.  Fix that by moving the call to
ctf_field_class_as_int below that check.

I went around and looked at all the uses of ctf_field_class_as_int, and
fixed some more instances of the same problem.

In some cases, I moved calls to ctf_field_class_as_int after
BT_COMP_LOGT calls.  While not necessary, my thinking is that should the
assert in ctf_field_class_as_int ever fail for these calls, it could be
able to see the output of the BT_COMP_LOGT, before crashing.

Add a test with a sequence whose length specifier is not an integer.

I also wrote an equivalent test for a variant whose selector is not an
enumeration.  It doesn't cause a crash, but I thought it would be a good
test to have anyway, I don't think we exercise that.

Change-Id: I0d375e9727572d97f129cdefdaad7bfa1a6102dc
Reviewed-on: https://review.lttng.org/c/babeltrace/+/9528
Tested-by: jenkins <jenkins@lttng.org>
Reviewed-by: Philippe Proulx <eeppeliteloop@gmail.com>
CI-Build: Simon Marchi <simon.marchi@efficios.com>
src/plugins/ctf/common/metadata/ctf-meta-resolve.cpp
src/plugins/ctf/common/metadata/ctf-meta.hpp
src/plugins/ctf/common/metadata/visitor-generate-ir.cpp
src/plugins/ctf/common/msg-iter/msg-iter.cpp
tests/data/ctf-traces/fail/invalid-sequence-length-field-class/metadata [new file with mode: 0644]
tests/data/ctf-traces/fail/invalid-variant-selector-field-class/metadata [new file with mode: 0644]
tests/plugins/src.ctf.fs/fail/test_fail
This page took 0.025358 seconds and 4 git commands to generate.