* [lttng-dev] [PATCH babeltrace] Fix ctf-writer: possible use after free
@ 2013-11-29 18:26 Jérémie Galarneau
2013-12-01 2:00 ` Mathieu Desnoyers
0 siblings, 1 reply; 2+ messages in thread
From: Jérémie Galarneau @ 2013-11-29 18:26 UTC (permalink / raw)
ctf_stream_pos' base_mma member must be copied from stream->pos before
updating the final packet and content sizes. The original base_mma
structure will be reallocated if the packet is resized.
Signed-off-by: J?r?mie Galarneau <jeremie.galarneau at efficios.com>
---
formats/ctf/writer/stream.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/formats/ctf/writer/stream.c b/formats/ctf/writer/stream.c
index ac89429..4efb369 100644
--- a/formats/ctf/writer/stream.c
+++ b/formats/ctf/writer/stream.c
@@ -464,7 +464,10 @@ int bt_ctf_stream_flush(struct bt_ctf_stream *stream)
/*
* Update the packet total size and content size and overwrite the
* packet context.
+ * Copy base_mma as the packet may have been remapped (e.g. when a
+ * packet is resized).
*/
+ packet_context_pos.base_mma = stream->pos.base_mma;
ret = set_structure_field_integer(stream_class->packet_context,
"content_size", stream->pos.offset);
if (ret) {
--
1.8.4.2
^ permalink raw reply [flat|nested] 2+ messages in thread* [lttng-dev] [PATCH babeltrace] Fix ctf-writer: possible use after free
2013-11-29 18:26 [lttng-dev] [PATCH babeltrace] Fix ctf-writer: possible use after free Jérémie Galarneau
@ 2013-12-01 2:00 ` Mathieu Desnoyers
0 siblings, 0 replies; 2+ messages in thread
From: Mathieu Desnoyers @ 2013-12-01 2:00 UTC (permalink / raw)
Merged, thanks!
Mathieu
----- Original Message -----
> From: "J?r?mie Galarneau" <jeremie.galarneau@efficios.com>
> To: lttng-dev at lists.lttng.org
> Sent: Friday, November 29, 2013 7:26:42 PM
> Subject: [lttng-dev] [PATCH babeltrace] Fix ctf-writer: possible use after free
>
> ctf_stream_pos' base_mma member must be copied from stream->pos before
> updating the final packet and content sizes. The original base_mma
> structure will be reallocated if the packet is resized.
>
> Signed-off-by: J?r?mie Galarneau <jeremie.galarneau at efficios.com>
> ---
> formats/ctf/writer/stream.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/formats/ctf/writer/stream.c b/formats/ctf/writer/stream.c
> index ac89429..4efb369 100644
> --- a/formats/ctf/writer/stream.c
> +++ b/formats/ctf/writer/stream.c
> @@ -464,7 +464,10 @@ int bt_ctf_stream_flush(struct bt_ctf_stream *stream)
> /*
> * Update the packet total size and content size and overwrite the
> * packet context.
> + * Copy base_mma as the packet may have been remapped (e.g. when a
> + * packet is resized).
> */
> + packet_context_pos.base_mma = stream->pos.base_mma;
> ret = set_structure_field_integer(stream_class->packet_context,
> "content_size", stream->pos.offset);
> if (ret) {
> --
> 1.8.4.2
>
>
> _______________________________________________
> lttng-dev mailing list
> lttng-dev at lists.lttng.org
> http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev
>
--
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-12-01 2:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-11-29 18:26 [lttng-dev] [PATCH babeltrace] Fix ctf-writer: possible use after free Jérémie Galarneau
2013-12-01 2:00 ` Mathieu Desnoyers
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox