efficios / barectf

Generator of ANSI C tracers which output CTF data streams
https://barectf.org
MIT License
65 stars 17 forks source link

Packet data size can be larger than packet size #5

Open eepp opened 8 years ago

eepp commented 8 years ago

The packet size is not checked before writing the initial packet header and packet context data. This can lead to a buffer overflow if the total initial packet data is larger than the given packet size.

The event's two-phase reserve/serialize logic should also be applied to the stream packet opening function. The PREFIX_STREAM_open_packet() function could leave the packet_is_open flag set to 0 in the stream context when it fails to reserve space, which would then be checked by _reserve_event_space(): if the packet is not open after calling cbs.open_packet(), then we discard this event. The next trace event function should try to open it again, again discarding the event if it still cannot be opened.