Fix: flt.utils.trimmer: bt_message_put_ref() on freed message
authorFrancis Deslauriers <francis.deslauriers@efficios.com>
Thu, 16 May 2019 00:14:42 +0000 (20:14 -0400)
committerJérémie Galarneau <jeremie.galarneau@efficios.com>
Thu, 16 May 2019 15:53:01 +0000 (11:53 -0400)
commit75a151671b0e3d2a90eeff2ccd1ab32d4a1729de
treed96b8769acc490218c1f2e17824aa19c896faa29
parentffb12c4fa3c8c131d0644b1a57595cde3a12ebbf
Fix: flt.utils.trimmer: bt_message_put_ref() on freed message

Issue
=====
In this function, we convert a timestamp in second to a clock value in
order to create a stream activity beginning message. We create a new
message and proceed to call `clock_raw_value_from_ns_from_origin()` to
convert the timestamp to a clock value.

If this call fails, we put the reference on this message using
`bt_message_put_ref()`. This frees the message as the refcount was at 1
because it was just created.

The problem here is that we don't reset the `msg` pointer and return it
to the call via the output parameter. This pointer points to freed data.
The caller then figures that the function failed by looking at the
return value and proceed to call `bt_message_put_ref()` again resulting
and assertion failure.

This can be easily triggered by passing a `begin` parameter of value 0
to a trimmer component.

Solution
========
Use a local variable to keep the pointer to the newly created message
and move that reference to the output parameter only on success.

Drawbacks
=========
None.

Signed-off-by: Francis Deslauriers <francis.deslauriers@efficios.com>
Change-Id: Id589f25d9ec6f555abd44ccb71e72af8e1684272
Reviewed-on: https://review.lttng.org/c/babeltrace/+/1314
Tested-by: jenkins
Reviewed-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
plugins/utils/trimmer/trimmer.c
This page took 0.025067 seconds and 4 git commands to generate.