From 2fa337d8533172a2803d29f1a3b727309380cb51 Mon Sep 17 00:00:00 2001
From: Cedric Roux <cedric.roux@eurecom.fr>
Date: Fri, 25 Apr 2025 11:49:31 +0200
Subject: [PATCH] T bugfix: include size of 'length' to allocated memory

The way allocation is done (granularity of 64KiB) makes a crash more
difficult to achieve, but if a trace is exactly 64KiB, we miss 4 bytes
in the realloc and then anything may happen.
---
 common/utils/T/tracer/extract_config.c        | 4 ++--
 common/utils/T/tracer/hacks/multi-rru-clean.c | 4 ++--
 common/utils/T/tracer/multi.c                 | 4 ++--
 common/utils/T/tracer/record.c                | 4 ++--
 common/utils/T/tracer/replay.c                | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/common/utils/T/tracer/extract_config.c b/common/utils/T/tracer/extract_config.c
index b908e60a83..73640cd3c1 100644
--- a/common/utils/T/tracer/extract_config.c
+++ b/common/utils/T/tracer/extract_config.c
@@ -46,8 +46,8 @@ int main(int n, char **v)
 
     /* read event from file */
     if (fread(&length, 4, 1, in) != 1) break;
-    if (ebuf.omaxsize < length) {
-      ebuf.omaxsize = (length + 65535) & ~65535;
+    if (ebuf.omaxsize < length + 4) {
+      ebuf.omaxsize = (length + 4 + 65535) & ~65535;
       ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
       if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
     }
diff --git a/common/utils/T/tracer/hacks/multi-rru-clean.c b/common/utils/T/tracer/hacks/multi-rru-clean.c
index ec7c8f9d1b..1887c9bb2b 100644
--- a/common/utils/T/tracer/hacks/multi-rru-clean.c
+++ b/common/utils/T/tracer/hacks/multi-rru-clean.c
@@ -157,8 +157,8 @@ int main(int n, char **v)
 
     /* read event from file */
     if (fread(&length, 4, 1, in) != 1) break;
-    if (ebuf.omaxsize < length) {
-      ebuf.omaxsize = (length + 65535) & ~65535;
+    if (ebuf.omaxsize < length + 4) {
+      ebuf.omaxsize = (length + 4 + 65535) & ~65535;
       ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
       if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
     }
diff --git a/common/utils/T/tracer/multi.c b/common/utils/T/tracer/multi.c
index 0b2e48ec7a..f10c520250 100644
--- a/common/utils/T/tracer/multi.c
+++ b/common/utils/T/tracer/multi.c
@@ -114,8 +114,8 @@ int read_tracee(int s, OBUF *ebuf, int *_type, int32_t *_length)
   int vpos = 0;
 
   if (fullread(s, &length, 4) == -1) return -1;
-  if (ebuf->omaxsize < length) {
-    ebuf->omaxsize = (length + 65535) & ~65535;
+  if (ebuf->omaxsize < length + 4) {
+    ebuf->omaxsize = (length + 4 + 65535) & ~65535;
     ebuf->obuf = realloc(ebuf->obuf, ebuf->omaxsize);
     if (ebuf->obuf == NULL) { printf("out of memory\n"); exit(1); }
   }
diff --git a/common/utils/T/tracer/record.c b/common/utils/T/tracer/record.c
index 9e3c4c41a3..d9f9f0837e 100644
--- a/common/utils/T/tracer/record.c
+++ b/common/utils/T/tracer/record.c
@@ -133,8 +133,8 @@ int main(int n, char **v)
     int vpos = 0;
 
     if (fullread(socket, &length, 4) == -1) goto read_error;
-    if (ebuf.omaxsize < length) {
-      ebuf.omaxsize = (length + 65535) & ~65535;
+    if (ebuf.omaxsize < length + 4) {
+      ebuf.omaxsize = (length + 4 + 65535) & ~65535;
       ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
       if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
     }
diff --git a/common/utils/T/tracer/replay.c b/common/utils/T/tracer/replay.c
index d9a505520a..10aec1588e 100644
--- a/common/utils/T/tracer/replay.c
+++ b/common/utils/T/tracer/replay.c
@@ -146,8 +146,8 @@ int main(int n, char **v)
 
     /* read event from file */
     if (fread(&length, 4, 1, in) != 1) break;
-    if (ebuf.omaxsize < length) {
-      ebuf.omaxsize = (length + 65535) & ~65535;
+    if (ebuf.omaxsize < length + 4) {
+      ebuf.omaxsize = (length + 4 + 65535) & ~65535;
       ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
       if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
     }