Fix: out-of-bound memory access

[babeltrace.git] / formats / ctf / ctf.c

diff --git a/formats/ctf/ctf.c b/formats/ctf/ctf.c
index a617497e05b719d544e5d662137632d4cb3d3718..0cf799cd224f1d35978d7268675032294ece52f1 100644 (file)
--- a/formats/ctf/ctf.c
+++ b/formats/ctf/ctf.c
@@ -951,6 +951,11 @@ void ctf_packet_seek(struct bt_stream_pos *stream_pos, size_t index, int whence)
                        assert(0);
                }
 
+               if (pos->cur_index >= pos->packet_index->len) {
+                       pos->offset = EOF;
+                       return;
+               }
+
                packet_index = &g_array_index(pos->packet_index,
                                struct packet_index, pos->cur_index);
                if (pos->cur_index > 0) {
@@ -963,11 +968,6 @@ void ctf_packet_seek(struct bt_stream_pos *stream_pos, size_t index, int whence)
                ctf_update_current_packet_index(&file_stream->parent,
                                prev_index, packet_index);
 
-               if (pos->cur_index >= pos->packet_index->len) {
-                       pos->offset = EOF;
-                       return;
-               }
-
                /*
                 * We need to check if we are in trace read or called
                 * from packet indexing.  In this last case, the
@@ -2113,6 +2113,7 @@ int ctf_open_trace_read(struct ctf_trace *td,
        struct dirent *dirent;
        struct dirent *diriter;
        size_t dirent_len;
+       int pc_name_max;
        char *ext;
 
        td->flags = flags;
@@ -2162,8 +2163,15 @@ int ctf_open_trace_read(struct ctf_trace *td,
         * the stream array.
         */
 
-       dirent_len = offsetof(struct dirent, d_name) +
-                       fpathconf(td->dirfd, _PC_NAME_MAX) + 1;
+       pc_name_max = fpathconf(td->dirfd, _PC_NAME_MAX);
+       if (pc_name_max < 0) {
+               perror("Error on fpathconf");
+               fprintf(stderr, "[error] Failed to get _PC_NAME_MAX for path \"%s\".\n", path);
+               ret = -1;
+               goto error_metadata;
+       }
+
+       dirent_len = offsetof(struct dirent, d_name) + pc_name_max + 1;
 
        dirent = malloc(dirent_len);