Fix: lttng: out-of-bound copy of arguments in 'view' command handler

[lttng-tools.git] / src / bin / lttng / commands / view.c

diff --git a/src/bin/lttng/commands/view.c b/src/bin/lttng/commands/view.c
index c9a5fdc3e09b0f356096a25a051c55d730ea86c8..8e63a8997837079f2ef97a00ea9cfbe985f4a167 100644 (file)
--- a/src/bin/lttng/commands/view.c
+++ b/src/bin/lttng/commands/view.c
@@ -188,7 +188,7 @@ static char **alloc_argv_from_local_opts(const char **opts, size_t opts_len,
                goto error;
        }
 
-       memcpy(argv, opts, size);
+       memcpy(argv, opts, sizeof(char *) * opts_len);
 
        if (session_live_mode) {
                argv[opts_len] = "-i";
@@ -302,6 +302,7 @@ static int view_trace(void)
        int ret;
        char *session_name, *trace_path = NULL;
        struct lttng_session *sessions = NULL;
+       bool free_trace_path = false;
 
        /*
         * Safety net. If lttng is suid at some point for *any* useless reasons,
@@ -379,6 +380,7 @@ static int view_trace(void)
                                ret = CMD_ERROR;
                                goto free_sessions;
                        }
+                       free_trace_path = true;
                } else {
                        /* Get file system session path. */
                        trace_path = sessions[i].path;
@@ -396,7 +398,7 @@ static int view_trace(void)
        }
 
 free_sessions:
-       if (session_live_mode) {
+       if (session_live_mode && free_trace_path) {
                free(trace_path);
        }
        free(sessions);
@@ -415,6 +417,7 @@ int cmd_view(int argc, const char **argv)
 {
        int opt, ret = CMD_SUCCESS;
        static poptContext pc;
+       const char *leftover = NULL;
 
        pc = poptGetContext(NULL, argc, argv, long_options, 0);
        poptReadDefaultConfig(pc, 0);
@@ -439,6 +442,13 @@ int cmd_view(int argc, const char **argv)
 
        opt_session_name = (char*) poptGetArg(pc);
 
+       leftover = poptGetArg(pc);
+       if (leftover) {
+               ERR("Unknown argument: %s", leftover);
+               ret = CMD_ERROR;
+               goto end;
+       }
+
        ret = view_trace();
 
 end: