barectf icon indicating copy to clipboard operation
barectf copied to clipboard

Packet data size can be larger than packet size

Open eepp opened this issue 9 years ago • 0 comments

The packet size is not checked before writing the initial packet header and packet context data. This can lead to a buffer overflow if the total initial packet data is larger than the given packet size.

The event's two-phase reserve/serialize logic should also be applied to the stream packet opening function. The PREFIX_STREAM_open_packet() function could leave the packet_is_open flag set to 0 in the stream context when it fails to reserve space, which would then be checked by _reserve_event_space(): if the packet is not open after calling cbs.open_packet(), then we discard this event. The next trace event function should try to open it again, again discarding the event if it still cannot be opened.

eepp avatar Mar 26 '16 19:03 eepp