[lttng-dev] [PATCH lttng-tools] Fix: insecure data handling

[Jérémie Galarneau]

Fixed by:

commit 02d8ac3daf181dc8b07bf206e8cd855e74e3fcd8
Author: Michael Jeanson <mjeanson at efficios.com>
Date:   Tue May 17 14:12:09 2016 -0400

    Fix: Free variable before strdup() in process_event_node

    Fixes coverity #1243040

    Signed-off-by: Michael Jeanson <mjeanson at efficios.com>
    Signed-off-by: Jérémie Galarneau <jeremie.galarneau at efficios.com>


Thanks,
Jérémie

On Mon, May 16, 2016 at 11:36 PM, Mathieu Desnoyers
<mathieu.desnoyers at efficios.com> wrote:
> Found by Coverity:
>
> CID 1353462 (#1 of 1): Use of untrusted string value (TAINTED_STRING)5.
> tainted_string: Passing tainted string man_bin_path to execlp, which
> cannot accept tainted data.
>
> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers at efficios.com>
> ---
>  src/common/utils.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/src/common/utils.c b/src/common/utils.c
> index df55dc9..b6b45e3 100644
> --- a/src/common/utils.c
> +++ b/src/common/utils.c
> @@ -1347,7 +1347,8 @@ end:
>
>  static const char *get_man_bin_path(void)
>  {
> -       char *env_man_path = getenv(DEFAULT_MAN_BIN_PATH_ENV);
> +       char *env_man_path =
> +               lttng_secure_getenv(DEFAULT_MAN_BIN_PATH_ENV);
>
>         if (env_man_path) {
>                 return env_man_path;
> --
> 2.1.4
>



-- 
Jérémie Galarneau
EfficiOS Inc.
http://www.efficios.com