[Title] fix the untrusted value as argument. (various)

[Desc.] add new function for read 4 bytes packet on vmodem/server/misc.c

diff --git a/packaging/vmodemd-emul.spec b/packaging/vmodemd-emul.spec
index c9880fe..9cf6f8e 100644 (file)
--- a/packaging/vmodemd-emul.spec
+++ b/packaging/vmodemd-emul.spec
@@ -1,6 +1,6 @@
 #git:slp/pkgs/v/vmodem-daemon-emulator
 Name: vmodemd-emul
-Version: 0.2.35
+Version: 0.2.36
 Release: 1
 Summary: Modem Emulator
 Group: System/ModemEmulator

diff --git a/vmodem/include/server/misc.h b/vmodem/include/server/misc.h
index f9d62a5..ad32c10 100644 (file)
--- a/vmodem/include/server/misc.h
+++ b/vmodem/include/server/misc.h
@@ -43,6 +43,7 @@ char const* printCurrentState(LXT_PHONE_STATE CurrentState);
 int packed_S32(unsigned char* bytearray);
 unsigned short packed_U16(unsigned char* bytearray);
 void PacketDataFree(void *p);
+int ReadPacketBytes4(int fd, void *data);
 int ReadBytes(int fd, void *data, int size);
 void* PacketDataMalloc(int size);
 int WriteBytes(int fd, void *data, int size);

diff --git a/vmodem/server/client.c b/vmodem/server/client.c
index f7eb2cb..1701b3a 100644 (file)
--- a/vmodem/server/client.c
+++ b/vmodem/server/client.c
@@ -1450,7 +1450,7 @@ static int client_callback(PhoneServer * ps, int fd, EloopCondition cond, void *
 
        TAPIMessageInit(&packet);
 
-       rc = ReadBytes(clientfd, &packet, 4);
+       rc = ReadPacketBytes4(clientfd, &packet);
 
        if  (rc <= 0)
        {

diff --git a/vmodem/server/misc.c b/vmodem/server/misc.c
index 86309a7..6924036 100644 (file)
--- a/vmodem/server/misc.c
+++ b/vmodem/server/misc.c
@@ -64,6 +64,33 @@ void PacketDataFree(void *p)
     }
 }
 
+int ReadPacketBytes4(int fd, void *data)
+{
+    int rc;
+    int size = 4;
+    LXT_MESSAGE tmp_buf;
+
+    if ( (data == 0) || (fd < 0) )
+    {
+        return -1;
+    }
+
+    rc = read(fd, &tmp_buf, size);
+
+    ((LXT_MESSAGE*)data)->length = (unsigned short)tmp_buf.length;
+    ((LXT_MESSAGE*)data)->group = (unsigned char)tmp_buf.group;
+    ((LXT_MESSAGE*)data)->action = (unsigned char)tmp_buf.action;
+
+
+    if (rc <= 0)
+    {
+        return -1;
+    }
+
+    return rc;
+
+}
+
 int ReadBytes(int fd, void *data, int size)
 {
     int rc;