Add out-of-bound checks

[babeltrace.git] / formats / ctf / ctf.c

diff --git a/formats/ctf/ctf.c b/formats/ctf/ctf.c
index 08834e9744318e944ae97ad006c43f8ca79b8bb0..f57d086efcef1ff235aeb7140388e5be17fb2665 100644 (file)
--- a/formats/ctf/ctf.c
+++ b/formats/ctf/ctf.c
@@ -324,8 +324,9 @@ int create_stream_packet_index(struct ctf_trace *td,
                /* read and check header, set stream id (and check) */
                if (td->packet_header) {
                        /* Read packet header */
-                       generic_rw(&pos->parent, &td->packet_header->p);
-
+                       ret = generic_rw(&pos->parent, &td->packet_header->p);
+                       if (ret)
+                               return ret;
                        len_index = struct_declaration_lookup_field_index(td->packet_header->declaration, g_quark_from_static_string("magic"));
                        if (len_index >= 0) {
                                struct definition_integer *defint;
@@ -409,8 +410,9 @@ int create_stream_packet_index(struct ctf_trace *td,
 
                if (stream->packet_context) {
                        /* Read packet context */
-                       generic_rw(&pos->parent, &stream->packet_context->p);
-
+                       ret = generic_rw(&pos->parent, &stream->packet_context->p);
+                       if (ret)
+                               return ret;
                        /* read content size from header */
                        len_index = struct_declaration_lookup_field_index(stream->packet_context->declaration, g_quark_from_static_string("content_size"));
                        if (len_index >= 0) {
@@ -448,6 +450,20 @@ int create_stream_packet_index(struct ctf_trace *td,
                        /* Use content size if non-zero, else file size */
                        packet_index.packet_size = packet_index.content_size ? : filestats.st_size * CHAR_BIT;
                }
+
+               /* Validate content size and packet size values */
+               if (packet_index.content_size > packet_index.packet_size) {
+                       fprintf(stdout, "[error] Content size (%zu bits) is larger than packet size (%zu bits).\n",
+                               packet_index.content_size, packet_index.packet_size);
+                       return -EINVAL;
+               }
+
+               if (packet_index.packet_size > filestats.st_size * CHAR_BIT) {
+                       fprintf(stdout, "[error] Packet size (%zu bits) is larger than file size (%zu bits).\n",
+                               packet_index.content_size, filestats.st_size * CHAR_BIT);
+                       return -EINVAL;
+               }
+
                /* Save position after header and context */
                packet_index.data_offset = pos->offset;