Fix for several issues detected by Prevent

[Issue#] SSDWSSP-107
[Problem] Issues detected by Prevent
[Cause] N/A
[Solution] Please see comments below
[Verification] Build and run

Changes:
* Added a sanity check for new_pwd_len in (prevent #42100)
* Added a check for result of setuid in security server test case
  (prevent #42102)
* Fixed a bug in one of the test cases (comparing smack labels)
  (prevent #43435)
* Fixed a bug where one error condition was not handled properly, which in turn
  led to double free.

Change-Id: I54562981cf5e1201f8f62852da5cb6b3473df138

diff --git a/src/security-srv/server/security-server-main.c b/src/security-srv/server/security-server-main.c
index 3fa401ceef9f3f06868965aa403bc4a349f77c4a..3cb63b15ad7aff2f1a7054eb28f3cc8527e2e6b8 100644 (file)
--- a/src/security-srv/server/security-server-main.c
+++ b/src/security-srv/server/security-server-main.c
@@ -943,7 +943,7 @@ int process_tool_request(int client_sockfd, int server_sockfd)
        memset(recved_argv, 0, sizeof(char *) * argcnum);
 
        retval = recv_launch_tool_request(client_sockfd, argcnum -1, recved_argv);
-       if(retval == SECURITY_SERVER_ERROR_RECV_FAILED)
+       if(retval == SECURITY_SERVER_ERROR_RECV_FAILED || retval == SECURITY_SERVER_ERROR_OUT_OF_MEMORY)
        {
                SEC_SVR_DBG("%s", "Receiving request failed");
                recved_argv = NULL;

diff --git a/src/security-srv/server/security-server-password.c b/src/security-srv/server/security-server-password.c
index a86c219d4717a346677d25a62023ef2b8ef69d20..491f0aaee351eb1ea15a860de0342c7c4d4186f5 100644 (file)
--- a/src/security-srv/server/security-server-password.c
+++ b/src/security-srv/server/security-server-password.c
@@ -762,7 +762,7 @@ int process_set_pwd_request(int sockfd)
                goto error;
        }
        retval = read(sockfd, &new_pwd_len, sizeof(char));
-       if(retval < sizeof(char)  || new_pwd_len > SECURITY_SERVER_MAX_PASSWORD_LEN)
+       if(retval < sizeof(char)  || new_pwd_len > SECURITY_SERVER_MAX_PASSWORD_LEN || new_pwd_len < 0)
        {
                SEC_SVR_DBG("Server Error: new password length recieve failed: %d, %d", retval, new_pwd_len);
                retval = send_generic_response(sockfd,