From: "Steven Rostedt (VMware)" <rostedt@xxxxxxxxxxx> When a record has 112 or fewer bytes (28 * 4) for size, it has a 4 byte record that contains 5 bits for the size of the event divided by 4, and 27 bits for the time delta. (0, 29, 30 31 are special values for those 5 bits. The split logic recreates the record header for each event it copies over from the source trace file to the destination trace file. To decide the header, it incorrectly checked for "less than" instead of "less than or equal to" of size "28 * 4". This caused the copying of the event to add the extended header. The issue happened, because of the added 4 bytes, it ended up overwriting the end of the page. The "\0" ended at the edge and was cut off. (There should be a better check for this as well). Fix the header check to use the compact header for 112 byte events. Fixes: 87d2a344a ("trace-cmd: Add split feature") Reported-by: Julia Lawall <julia.lawall@xxxxxxxx> Signed-off-by: Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx> --- tracecmd/trace-split.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tracecmd/trace-split.c b/tracecmd/trace-split.c index 233feb89..9b1a8d7a 100644 --- a/tracecmd/trace-split.c +++ b/tracecmd/trace-split.c @@ -106,7 +106,7 @@ static int write_record(struct tracecmd_input *handle, return 0; } - if (record->size && (record->size < 28 * 4)) + if (record->size && (record->size <= 28 * 4)) len = record->size / 4; time = (unsigned)diff; -- 2.29.2