Crashtracker: fix a use-after-free error

DataDog · Sep 10, 2024 · ed07274 · ed07274
1 parent 98839cf
commit ed07274
Showing 1 changed file with 14 additions and 6 deletions.
diff --git a/ext/signals.c b/ext/signals.c
@@ -37,7 +37,7 @@
 // true globals; only modify in MINIT/MSHUTDOWN
 static stack_t ddtrace_altstack;
 static struct sigaction ddtrace_sigaction;
-static ddog_CharSlice crashtracker_socket_path = {0};
+static char crashtracker_socket_path[100] = {0};
 
 #define MAX_STACK_SIZE 1024
 #define MIN_STACKSZ 16384  // enough to hold void *array[MAX_STACK_SIZE] plus a couple kilobytes
@@ -101,8 +101,19 @@ static bool ddtrace_crashtracker_check_result(ddog_crasht_Result result, const c
 }
 
 static void ddtrace_init_crashtracker() {
+    ddog_CharSlice socket_path = ddog_sidecar_get_crashtracker_unix_socket_path();
+    if (socket_path.len > sizeof(crashtracker_socket_path) - 1) {
+        LOG(ERROR, "Cannot initialize CrashTracker : the socket path is too long.");
+        free((void *) socket_path.ptr);
+        return;
+    }
+
+    // Copy the string to a global buffer to avoid a use-after-free error
+    strncpy(crashtracker_socket_path, socket_path.ptr, sizeof(crashtracker_socket_path) - 1);
+    free((void *) socket_path.ptr);
+    socket_path.ptr = crashtracker_socket_path;
+
     ddog_Endpoint *agent_endpoint = ddtrace_sidecar_agent_endpoint();
-    crashtracker_socket_path = ddog_sidecar_get_crashtracker_unix_socket_path();
 
     ddog_crasht_Config config = {
         .endpoint = agent_endpoint,
@@ -139,7 +150,7 @@ static void ddtrace_init_crashtracker() {
     ddtrace_crashtracker_check_result(
         ddog_crasht_init_with_unix_socket(
             config,
-            crashtracker_socket_path,
+            socket_path,
             metadata
         ),
         "Cannot initialize CrashTracker"
@@ -183,9 +194,6 @@ void ddtrace_signals_first_rinit(void) {
 
 void ddtrace_signals_mshutdown(void) {
     free(ddtrace_altstack.ss_sp);
-    if (crashtracker_socket_path.ptr) {
-        free((void *) crashtracker_socket_path.ptr);
-    }
 }
 
 #else