fix overflow issue with strncat(TSAM_10563)

Change-Id: I97c7469e706df002ee3fcaf4d9aa8fcfa86104a0
Signed-off-by: intae, jeon <intae.jeon@samsung.com>

diff --git a/email-core/email-core-mail.c b/email-core/email-core-mail.c
index 0e922ca..8fa9146 100755 (executable)
--- a/email-core/email-core-mail.c
+++ b/email-core/email-core-mail.c
@@ -7837,6 +7837,19 @@ FINISH_OFF:
        EM_DEBUG_FUNC_END();
        return err;
 }
+static int get_filter_string_length(char *filter_string)
+{
+
+       EM_DEBUG_FUNC_BEGIN("filter_string : [%p]", filter_string);
+       int filter_string_length = 0;
+       int length = 0;
+
+       filter_string_length = strlen(filter_string);
+       length = (MAX_PREVIEW_TEXT_LENGTH - filter_string_length) > STRING_LENGTH_FOR_DISPLAY ? STRING_LENGTH_FOR_DISPLAY :(MAX_PREVIEW_TEXT_LENGTH - filter_string_length);
+
+       EM_DEBUG_FUNC_END();
+       return length;
+}
 
 static int get_search_filter_string(email_search_filter_t *search_filter, int search_filter_count, char **output_filter_string)
 {
@@ -7870,7 +7883,9 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                                        }
 
                                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "OR ");
-                                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+                                       /* TODO it will use realloc */
+
+                                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                                }
                        }
                        break;
@@ -7881,14 +7896,16 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                                SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "ANSWERED ");
                        else
                                SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "UNANSWERED ");
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_BCC:
                    EM_DEBUG_LOG_SEC("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "BCC \"%s\" ",
                                                search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_SENT_DATE_BEFORE:
@@ -7896,7 +7913,8 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        emcore_make_date_string_for_search(search_filter[i].search_filter_key_value.time_type_key_value,
                                                                                                &time_string);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "BEFORE %s ", time_string);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        EM_SAFE_FREE(time_string);
                        break;
 
@@ -7904,14 +7922,16 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                    EM_DEBUG_LOG_SEC("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "BODY \"%s\" ",
                                                search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_CC:
                    EM_DEBUG_LOG_SEC("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "CC \"%s\" ",
                                                search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_FLAGS_DELETED:
@@ -7921,7 +7941,7 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        else
                                SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "UNDELETED ");
 
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_FLAGS_FLAGED:
@@ -7931,14 +7951,15 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        else
                                SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "UNFLAGGED ");
 
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_FROM:
                    EM_DEBUG_LOG_SEC("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "FROM \"%s\" ",
                                                search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_KEYWORD:
@@ -7946,7 +7967,7 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "KEYWORD \"%s\" ",
                                                search_filter[i].search_filter_key_value.string_type_key_value);
 
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_FLAGS_NEW:
@@ -7954,7 +7975,7 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        if (search_filter[i].search_filter_key_value.integer_type_key_value)
                                SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "NEW ");
 
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_FLAGS_OLD:
@@ -7962,7 +7983,7 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        if (search_filter[i].search_filter_key_value.integer_type_key_value)
                                SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "OLD ");
 
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_SENT_DATE_ON:
@@ -7970,7 +7991,8 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        emcore_make_date_string_for_search(search_filter[i].search_filter_key_value.time_type_key_value,
                                                                                                &time_string);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "ON %s ", time_string);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        EM_SAFE_FREE(time_string);
                        break;
 
@@ -7978,7 +8000,8 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        EM_DEBUG_LOG("integer_type_key_value [%d]", search_filter[i].search_filter_key_value.integer_type_key_value);
                        if (search_filter[i].search_filter_key_value.integer_type_key_value)
                                SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "RECENT ");
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_FLAGS_SEEN:
@@ -7988,7 +8011,7 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        else
                                SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "UNSEEN ");
 
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_SENT_DATE_SINCE:
@@ -7996,7 +8019,8 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        emcore_make_date_string_for_search(search_filter[i].search_filter_key_value.time_type_key_value,
                                                                                                &time_string);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "SINCE %s ", time_string);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        EM_SAFE_FREE(time_string);
                        break;
 
@@ -8004,27 +8028,31 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                        EM_DEBUG_LOG_SEC("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "SUBJECT \"%s\" ",
                                                search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_TEXT:
                    EM_DEBUG_LOG_SEC("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "TEXT \"%s\" ",
                                                search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_TO:
                    EM_DEBUG_LOG_SEC("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "TO \"%s\" ",
                                                search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_HEADER_PRIORITY:
                        EM_DEBUG_LOG("integer_type_key_value [%d]", search_filter[i].search_filter_key_value.integer_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "HEADER x-priority %d ", search_filter[i].search_filter_key_value.integer_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_SIZE_LARSER:
@@ -8043,20 +8071,23 @@ static int get_search_filter_string(email_search_filter_t *search_filter, int se
                    EM_DEBUG_LOG_SEC("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "X-GM-RAW \"has:attachment filename:%s\" ",
                                                search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_CHARSET:
                        EM_DEBUG_LOG("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "charset %s ", search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
 
                case EMAIL_SEARCH_FILTER_TYPE_USER_DEFINED:
                        EM_DEBUG_LOG("string_type_key_value [%s]", search_filter[i].search_filter_key_value.string_type_key_value);
                        SNPRINTF(temp_criteria, STRING_LENGTH_FOR_DISPLAY, "%s", search_filter[i].search_filter_key_value.string_type_key_value);
-                       strncat(filter_string, temp_criteria, STRING_LENGTH_FOR_DISPLAY);
+
+                       strncat(filter_string, temp_criteria, get_filter_string_length(filter_string));
                        break;
 
                case EMAIL_SEARCH_FILTER_TYPE_MESSAGE_NO: