Fix: lttng: out-of-bound copy of arguments in 'view' command handler
authorJérémie Galarneau <jeremie.galarneau@efficios.com>
Thu, 19 Sep 2019 18:24:34 +0000 (14:24 -0400)
committerJérémie Galarneau <jeremie.galarneau@efficios.com>
Thu, 19 Sep 2019 18:33:21 +0000 (14:33 -0400)
commite20ca0249f0a7b3b8e2d8f50437e63ea17b8f6e9
tree8c959a3d1b43f1bbd15ceb9133d6e2b0ffafce23
parent1da8d15ab5d1681b89567987fac70ca3b0703ba6
Fix: lttng: out-of-bound copy of arguments in 'view' command handler

The 'size' operand of memcpy() does not indicate the length of the
opts array; it is the size of the resulting array once the opts array
is concatenated with the options being added in this function. This
results in out-of-bound read(s) in the opts array.

Use 'sizeof(char *) * opts_len' as the length to copy at the beginning
of the resulting array.

Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
src/bin/lttng/commands/view.c
This page took 0.026366 seconds and 5 git commands to generate.