Prevent invalid memory accress

- This patch prevents bad memory access
- If you try to read data larger than parcel size, the data read will be
  empty

Change-Id: I7792cb9d36b247bea61c3dfc19e55b44aac7af69
Signed-off-by: Junghoon Park <jh9216.park@samsung.com>

diff --git a/src/parcel-internal.cc b/src/parcel-internal.cc
index cae8988..6ece0b9 100644 (file)
--- a/src/parcel-internal.cc
+++ b/src/parcel-internal.cc
@@ -99,7 +99,11 @@ double Parcel::ReadDouble() {
 const char* Parcel::ReadString() {
   int l = Read<int>();
 
+  if (l <= 0)
+    return nullptr;
   const char* str = reinterpret_cast<const char*>(&data_[reader_]);
+  if (static_cast<int>(strlen(str) + 1) != l)
+    return nullptr;
   reader_ += l;
 
   return str;
@@ -112,7 +116,11 @@ bool Parcel::ReadBool() {
 bundle* Parcel::ReadBundle() {
   int l = Read<int>();
 
+  if (l <= 0)
+    return nullptr;
   const bundle_raw* str = reinterpret_cast<const bundle_raw*>(&data_[reader_]);
+  if (static_cast<int>(strlen(reinterpret_cast<const char*>(str)) + 1) != l)
+    return nullptr;
   reader_ += l;
 
   bundle* b = bundle_decode(str, l - 1);
@@ -133,6 +141,8 @@ void Parcel::Write(const unsigned char* buf, unsigned int size) {
 }
 
 void Parcel::Read(unsigned char* buf, unsigned int size) {
+  if (reader_ + size > data_.size())
+      return;
   std::copy(&data_[reader_], &data_[reader_] + size, buf);
   reader_ += size;
 }

diff --git a/src/parcel-internal.h b/src/parcel-internal.h
index 3b491d0..ac2290a 100644 (file)
--- a/src/parcel-internal.h
+++ b/src/parcel-internal.h
@@ -65,9 +65,11 @@ class Parcel {
 
   template<typename T>
   T Read() {
-    T d;
+    T d = 0;
     unsigned char* p = reinterpret_cast<unsigned char*>(&d);
 
+    if (reader_ + sizeof(T) > data_.size())
+      return d;
     std::copy(&data_[reader_], &data_[reader_] + sizeof(T), p);
     reader_ += sizeof(T);
     return d;

diff --git a/src/rpc-port-parcel.cc b/src/rpc-port-parcel.cc
index 307808a..f49d9e2 100755 (executable)
--- a/src/rpc-port-parcel.cc
+++ b/src/rpc-port-parcel.cc
@@ -297,8 +297,8 @@ RPC_API int rpc_port_parcel_read_string(rpc_port_parcel_h h, char** str) {
     return RPC_PORT_ERROR_INVALID_PARAMETER;
 
   Parcel* p = static_cast<Parcel*>(h);
-
-  *str = strdup(p->ReadString());
+  const char* read = p->ReadString();
+  *str = read == nullptr ? strdup("") : strdup(read);
 
   return RPC_PORT_ERROR_NONE;
 }
@@ -319,8 +319,9 @@ RPC_API int rpc_port_parcel_read_bundle(rpc_port_parcel_h h, bundle** b) {
     return RPC_PORT_ERROR_INVALID_PARAMETER;
 
   Parcel* p = static_cast<Parcel*>(h);
+  bundle* read = p->ReadBundle();
 
-  *b = p->ReadBundle();
+  *b = read == nullptr ? bundle_create() : read;
 
   return RPC_PORT_ERROR_NONE;
 }