[Non-ACR][email-service][sql injection fix]

Change-Id: I8ea05e4e0eaccf48a3120dadc8439fdef0cbc19d
Signed-off-by: Sameer Prakash Pradhan <sp.pradhan@samsung.com>

diff --git a/email-core/email-storage/email-storage.c b/email-core/email-storage/email-storage.c
index bb86c67..336d830 100755 (executable)
--- a/email-core/email-storage/email-storage.c
+++ b/email-core/email-storage/email-storage.c
@@ -1481,24 +1481,25 @@ static int emstorage_exec_query_by_prepare_v2_stmt(sqlite3 *local_db_handle, cha
 
        EMSTORAGE_PROTECTED_FUNC_CALL(sqlite3_prepare_v2(local_db_handle, query_string, EM_SAFE_STRLEN(query_string), &db_statement, NULL), rc);
 
-       _bind_stmt_field_data_string(db_statement, count++, target_mailbox_name, 0, EM_SAFE_STRLEN(target_mailbox_name)-1);
+       EM_DEBUG_DB_EXEC((SQLITE_OK != rc), {error = EMAIL_ERROR_DB_FAILURE; goto FINISH_OFF; },
+                       ("sqlite3_prepare_stmt failed [%d] [%s]", rc, query_string));
+
+       _bind_stmt_field_data_string(db_statement, count++, target_mailbox_name, 0, MAILBOX_NAME_LEN_IN_MAIL_BOX_TBL);
        _bind_stmt_field_data_int(db_statement, count++, input_mailbox_id);
        _bind_stmt_field_data_int(db_statement, count++, target_account_id);
 
 
-       EM_DEBUG_DB_EXEC((SQLITE_OK != rc), {error = EMAIL_ERROR_DB_FAILURE; goto FINISH_OFF; },
-                       ("sqlite3_prepare failed [%d] [%s]", rc, query_string));
 
        EMSTORAGE_PROTECTED_FUNC_CALL(sqlite3_step(db_statement), rc);
        EM_DEBUG_DB_EXEC((rc != SQLITE_ROW && rc != SQLITE_DONE), {error = EMAIL_ERROR_DB_FAILURE; goto FINISH_OFF; },
-                       ("sqlite3_step failed [%d] [%s]", rc, query_string));
+                       ("sqlite3_step_stmt failed [%d] [%s]", rc, query_string));
 
 FINISH_OFF:
 
        if (db_statement != NULL) {
                rc = sqlite3_finalize(db_statement);
                if (rc != SQLITE_OK) {
-                       EM_DEBUG_EXCEPTION("sqlite3_finalize error [%d]", rc);
+                       EM_DEBUG_EXCEPTION("sqlite3_finalize_stmt error [%d]", rc);
                        error = EMAIL_ERROR_DB_FAILURE;
                }
        }
@@ -9991,7 +9992,7 @@ INTERNAL_FUNC int emstorage_move_multiple_mails_on_db(char *multi_user_name, int
        EM_DEBUG_LOG_SEC("Query [%s]", sql_query_string);
        error = emstorage_exec_query_by_prepare_v2_stmt(local_db_handle, sql_query_string, target_mailbox_name, input_mailbox_id, target_account_id);
        if (error != EMAIL_ERROR_NONE) {
-               EM_DEBUG_EXCEPTION("emstorage_exec_query_by_prepare_v2 failed:[%d]", error);
+               EM_DEBUG_EXCEPTION("emstorage_exec_query_by_prepare_v2_stmt failed:[%d]", error);
                goto FINISH_OFF;
        }