[IOT-2441] Initialize OCByteString.

OCByteStringCopy tries to free any existing
buffer.  When OCByteString is not initialized it
is possible to free an invalid pointer.

Bug: https://jira.iotivity.org/browse/IOT-2441
Change-Id: Ic5ebf559f4a33ffed7864163238bb304342b794a
Signed-off-by: Todd Malsbary <todd.malsbary@intel.com>
Reviewed-on: https://gerrit.iotivity.org/gerrit/20959
Tested-by: jenkins-iotivity <jenkins@iotivity.org>
Reviewed-by: Dan Mihai <Daniel.Mihai@microsoft.com>

diff --git a/resource/csdk/stack/include/ocpayload.h b/resource/csdk/stack/include/ocpayload.h
index 614a69b..a674517 100644 (file)
--- a/resource/csdk/stack/include/ocpayload.h
+++ b/resource/csdk/stack/include/ocpayload.h
@@ -295,7 +295,7 @@ char* OC_CALL OCCreateString(const OCStringLL* ll);
 
 /**
  * This function copies contents (and allocates if necessary)
- * @param dest existing bytestring (or null to allocate here)
+ * @param dest existing bytestring.  The existing contents will be OICFree()'d.
  * @param source existing bytestring
  * @return true of success false on any errors
  **/

diff --git a/resource/csdk/stack/src/ocpayload.c b/resource/csdk/stack/src/ocpayload.c
index 6012f90..7eb6832 100644 (file)
--- a/resource/csdk/stack/src/ocpayload.c
+++ b/resource/csdk/stack/src/ocpayload.c
@@ -176,7 +176,7 @@ static void OC_CALL OCCopyPropertyValueArray(OCRepPayloadValue* dest, OCRepPaylo
             }
             break;
         case OCREP_PROP_BYTE_STRING:
-            dest->arr.ocByteStrArray = (OCByteString*)OICMalloc(dimTotal * sizeof(OCByteString));
+            dest->arr.ocByteStrArray = (OCByteString*)OICCalloc(dimTotal, sizeof(OCByteString));
             VERIFY_PARAM_NON_NULL(TAG, dest->arr.ocByteStrArray, "Failed allocating memory");
             for (size_t i = 0; i < dimTotal; ++i)
             {
@@ -1554,13 +1554,9 @@ char* OC_CALL OCCreateString(const OCStringLL* ll)
 
 bool OC_CALL OCByteStringCopy(OCByteString* dest, const OCByteString* source)
 {
-    VERIFY_PARAM_NON_NULL(TAG, source, "Bad input");
+    VERIFY_PARAM_NON_NULL(TAG, dest, "Bad dest");
+    VERIFY_PARAM_NON_NULL(TAG, source, "Bad source");
 
-    if (!dest)
-    {
-        dest = (OCByteString *)OICMalloc(sizeof(OCByteString));
-        VERIFY_PARAM_NON_NULL(TAG, dest, "Failed allocating memory");
-    }
     if (dest->bytes)
     {
         OICFree(dest->bytes);

diff --git a/service/notification/src/consumer/NSConsumerCommon.c b/service/notification/src/consumer/NSConsumerCommon.c
index 89dbdb8..1fe086a 100644 (file)
--- a/service/notification/src/consumer/NSConsumerCommon.c
+++ b/service/notification/src/consumer/NSConsumerCommon.c
@@ -901,7 +901,7 @@ void NSCopyPayloadValueArray(OCRepPayloadValue* dest, OCRepPayloadValue* source)
             }
             break;
         case OCREP_PROP_BYTE_STRING:
-            dest->arr.ocByteStrArray = (OCByteString*)OICMalloc(dimTotal * sizeof(OCByteString));
+            dest->arr.ocByteStrArray = (OCByteString*)OICCalloc(dimTotal, sizeof(OCByteString));
             NS_VERIFY_NOT_NULL_V(dest->arr.ocByteStrArray);
             for (size_t i = 0; i < dimTotal; ++i)
             {