Changeset 199

Timestamp:

04/20/10 16:01:16 (15 years ago)

Author:

daqct3

Message:

Bug in ToString() resulted in buffer overflow for structure

Location:

Evidence

Files:

• DColl.cc (modified) (5 diffs)
• Evidence.cc (modified) (1 diff)

Evidence/DColl.cc

@@ -221 +221 @@
         char *Token = strtok(Info->getString(), "+-!@");        
         while (Token != NULL) {
-          if (*Info->getString()=='-' || *Info->getString()=='!') ; // RemoveService(string(Token)+"/SERVICE_LIST");      
+          if (*Info->getString()=='-' || *Info->getString()=='!') RemoveService(string(Token)+"/SERVICE_LIST");   
           else AddService(string(Token)+"/SERVICE_LIST");
           Token = strtok(NULL, "|"); // Skip server IP address
@@ -239 +239 @@
       if (strstr(Type, "|CMD")==NULL && strstr(Type, "|RPC")==NULL) {
             // Add or remove service
-            if (*Info->getString()=='-' || *Info->getString()=='!') ; // RemoveService(Name);
+            if (*Info->getString()=='-' || *Info->getString()=='!') RemoveService(Name);
                 else AddService(Name);
           }
@@ -350 +350 @@
   // ====== Part D: Handle history service ===
   //
-  
+
   if (Info->getSize() == 0) return;
 
@@ -468 +468 @@
         if (Name == List[i].DataItem->getName()) return;
   }
-  
+
+  // Set minimum required change by comparing to regular expressions
   struct Item New;
-
-  // Set minimum required change by comparing to regular expressions
   New.MinAbsChange = 0;
   New.HistSize = 0;
@@ -505 +504 @@
         }
   }
-  
+
   // Subscribe to service
   New.DataItem = new DimStampedInfo(Name.c_str(), NO_LINK, this);

Evidence/Evidence.cc

@@ -240 +240 @@
   char *Text;
 
+  // Safety check
+  if (Item->getSize() < 1) return NULL;
+  
   // Structure: print hex representation (3 characters per byte)  
   if (strlen(Item->getFormat()) != 1) {
-    if ((Text = (char *) malloc(3*Item->getSize()+1)) != NULL) {
-          for (int i=0; i<Item->getSize(); i++) sprintf(Text+3*i, "%02x", *((char *) Item->getData() + i)); 
-        }
+    int Size = 3*Item->getSize()+1, N;
+    if ((Text = (char *) malloc(Size)) == NULL) return NULL;
+        
+        char *CurrPos = Text;
+        for (int i=0; i<Item->getSize(); i++) {
+          N = snprintf(CurrPos, Size, "%02x ", *((char *) Item->getData() + i));
+          if (N<0 || N>=Size) {
+            free(Text);
+                if (asprintf(&Text, "Structure length %d bytes, buffer overflow in ToString()", Item->getSize()) == -1) return NULL;
+                else return Text;
+          }
+          Size -= N;
+          CurrPos += N;
+        } 
         return Text;
   }