Add out-of-bound checks

[babeltrace.git] / formats / ctf / ctf.c

diff --git a/formats/ctf/ctf.c b/formats/ctf/ctf.c
index e375039b84c1bbf132add88d1dd9d29afc84e043..f57d086efcef1ff235aeb7140388e5be17fb2665 100644 (file)
--- a/formats/ctf/ctf.c
+++ b/formats/ctf/ctf.c
@@ -324,8 +324,9 @@ int create_stream_packet_index(struct ctf_trace *td,
                /* read and check header, set stream id (and check) */
                if (td->packet_header) {
                        /* Read packet header */
-                       generic_rw(&pos->parent, &td->packet_header->p);
-
+                       ret = generic_rw(&pos->parent, &td->packet_header->p);
+                       if (ret)
+                               return ret;
                        len_index = struct_declaration_lookup_field_index(td->packet_header->declaration, g_quark_from_static_string("magic"));
                        if (len_index >= 0) {
                                struct definition_integer *defint;
@@ -409,8 +410,9 @@ int create_stream_packet_index(struct ctf_trace *td,
 
                if (stream->packet_context) {
                        /* Read packet context */
-                       generic_rw(&pos->parent, &stream->packet_context->p);
-
+                       ret = generic_rw(&pos->parent, &stream->packet_context->p);
+                       if (ret)
+                               return ret;
                        /* read content size from header */
                        len_index = struct_declaration_lookup_field_index(stream->packet_context->declaration, g_quark_from_static_string("content_size"));
                        if (len_index >= 0) {
@@ -448,6 +450,20 @@ int create_stream_packet_index(struct ctf_trace *td,
                        /* Use content size if non-zero, else file size */
                        packet_index.packet_size = packet_index.content_size ? : filestats.st_size * CHAR_BIT;
                }
+
+               /* Validate content size and packet size values */
+               if (packet_index.content_size > packet_index.packet_size) {
+                       fprintf(stdout, "[error] Content size (%zu bits) is larger than packet size (%zu bits).\n",
+                               packet_index.content_size, packet_index.packet_size);
+                       return -EINVAL;
+               }
+
+               if (packet_index.packet_size > filestats.st_size * CHAR_BIT) {
+                       fprintf(stdout, "[error] Packet size (%zu bits) is larger than file size (%zu bits).\n",
+                               packet_index.content_size, filestats.st_size * CHAR_BIT);
+                       return -EINVAL;
+               }
+
                /* Save position after header and context */
                packet_index.data_offset = pos->offset;
 
@@ -573,30 +589,6 @@ error:
        return ret;
 }
 
-static
-int ctf_open_trace_write(struct ctf_trace *td, const char *path, int flags)
-{
-       int ret;
-
-       ret = mkdir(path, S_IRWXU|S_IRWXG);
-       if (ret)
-               return ret;
-
-       /* Open trace directory */
-       td->dir = opendir(path);
-       if (!td->dir) {
-               fprintf(stdout, "[error] Unable to open trace directory.\n");
-               ret = -ENOENT;
-               goto error;
-       }
-       
-
-       return 0;
-
-error:
-       return ret;
-}
-
 struct trace_descriptor *ctf_open_trace(const char *path, int flags)
 {
        struct ctf_trace *td;
@@ -606,6 +598,10 @@ struct trace_descriptor *ctf_open_trace(const char *path, int flags)
 
        switch (flags & O_ACCMODE) {
        case O_RDONLY:
+               if (!path) {
+                       fprintf(stdout, "[error] Path missing for input CTF trace.\n");
+                       goto error;
+               }
                ret = ctf_open_trace_read(td, path, flags);
                if (ret)
                        goto error;
@@ -613,12 +609,6 @@ struct trace_descriptor *ctf_open_trace(const char *path, int flags)
        case O_WRONLY:
                fprintf(stdout, "[error] Opening CTF traces for output is not supported yet.\n");
                goto error;
-#if 0
-               ret = ctf_open_trace_write(td, path, flags);
-               if (ret)
-                       goto error;
-#endif //0
-               break;
        default:
                fprintf(stdout, "[error] Incorrect open flags.\n");
                goto error;