[SATIZENVUL-1315,1316] Reinforced the missing code

Change-Id: I022f80b0b1cefad8626aa94b71383e4dfeb1c480
Signed-off-by: Minje Ahn <minje.ahn@samsung.com>

diff --git a/lib/include/media-server-ipc.h b/lib/include/media-server-ipc.h
index 177c6b4..cd52b79 100755 (executable)
--- a/lib/include/media-server-ipc.h
+++ b/lib/include/media-server-ipc.h
@@ -69,7 +69,6 @@ typedef enum {
        MS_MSG_SCANNER_COMPLETE,
        MS_MSG_EXTRACTOR_COMPLETE,
        MS_MSG_MEDIA_DB_RESET,  /**< media DB is reset*/
-       MS_MSG_RECEIVE_MSG_FAILED,   /**ms_ipc_receive_message_tcp failed**/
        MS_MSG_MEDIA_DB_MALFORMED,
        MS_MSG_MAX                                                      /**< Invalid msg type */
 } ms_msg_type_e;

diff --git a/lib/include/media-util-register.h b/lib/include/media-util-register.h
index 69fea6f..448a214 100755 (executable)
--- a/lib/include/media-util-register.h
+++ b/lib/include/media-util-register.h
@@ -36,7 +36,6 @@ typedef enum {
        MEDIA_REQUEST_SCAN_PARTIAL,
        MEDIA_REQUEST_SCAN_COMPLETE,
        MEDIA_REQUEST_EXTRACT_COMPLETE,
-       MEDIA_REQUEST_ERROR_SERVER_RECEIVE_MSG_FAILED,
 } media_request_type_e;
 
 typedef struct {

diff --git a/lib/media-util-cynara.c b/lib/media-util-cynara.c
index a9602b1..7fb8aaf 100755 (executable)
--- a/lib/media-util-cynara.c
+++ b/lib/media-util-cynara.c
@@ -112,13 +112,18 @@ int ms_cynara_receive_untrusted_message(int sockfd, ms_comm_msg_s *recv_msg, ms_
                }
        }
 
-       MSAPI_DBG_SLOG("receive msg from [%d] %d, %s", recv_msg->pid, recv_msg->msg_type, recv_msg->msg);
+       MSAPI_DBG_SLOG("receive msg from P[%d] T[%d] M[%.*s] S[%.*s]", recv_msg->pid, recv_msg->msg_type, MAX_MSG_SIZE, recv_msg->msg, MS_UUID_SIZE, recv_msg->storage_id);
 
        if (strlen(recv_msg->msg) == 0 || strlen(recv_msg->msg) >= MAX_MSG_SIZE) {
                MSAPI_DBG_ERR("IPC message is wrong. message size is %d", strlen(recv_msg->msg));
                return MS_MEDIA_ERR_INVALID_IPC_MESSAGE;
        }
 
+       if (strlen(recv_msg->storage_id) >= MS_UUID_SIZE) {
+               MSAPI_DBG_ERR("IPC message is wrong. storage_id size is %d", strlen(recv_msg->storage_id));
+               return MS_MEDIA_ERR_INVALID_IPC_MESSAGE;
+       }
+
        ret = cynara_creds_socket_get_pid(sockfd, &(credentials->pid));
        MSAPI_RETVM_IF(ret != 0, MS_MEDIA_ERR_INTERNAL, "[CYNARA]Failed to get pid");
 
@@ -161,6 +166,16 @@ int ms_cynara_receive_untrusted_message_thumb(int sockfd, thumbMsg *recv_msg, ms
        memcpy(recv_msg, buf, header_size);
        MS_SAFE_FREE(buf);
 
+       if (strlen(recv_msg->org_path) == 0 || strlen(recv_msg->org_path) >= MAX_FILEPATH_LEN) {
+               MSAPI_DBG_ERR("org_path size is invlid[%d]", strlen(recv_msg->org_path));
+               return MS_MEDIA_ERR_INVALID_IPC_MESSAGE;
+       }
+
+       if (strlen(recv_msg->dst_path) >= MAX_FILEPATH_LEN) {
+               MSAPI_DBG_ERR("dst_path size is invlid[%d]", strlen(recv_msg->dst_path));
+               return MS_MEDIA_ERR_INVALID_IPC_MESSAGE;
+       }
+
        ret = cynara_creds_socket_get_pid(sockfd, &(credentials->pid));
        MSAPI_RETVM_IF(ret != 0, MS_MEDIA_ERR_INTERNAL, "[CYNARA]Failed to get pid");
 

diff --git a/lib/media-util-dcm.c b/lib/media-util-dcm.c
index 7434d12..87e3ac0 100755 (executable)
--- a/lib/media-util-dcm.c
+++ b/lib/media-util-dcm.c
@@ -144,7 +144,7 @@ gboolean __media_dcm_write_socket(GIOChannel *src, GIOCondition condition, gpoin
 
        if ((err = recv(sock, &recv_msg, sizeof(dcmMsg), 0)) < 0) {
                MSAPI_DBG_STRERROR("recv failed ");
-               if (strlen(recv_msg.msg) > 0)
+               if (strlen(recv_msg.msg) > 0 && strlen(recv_msg.msg) < MAX_FILEPATH_LEN)
                        __media_dcm_pop_data();
                else
                        MSAPI_DBG_ERR("origin path size is wrong.");
@@ -152,7 +152,12 @@ gboolean __media_dcm_write_socket(GIOChannel *src, GIOCondition condition, gpoin
                return FALSE;
        }
 
-       MSAPI_DBG("Completed. msg_type[%d], msg[%s], result[%d]", recv_msg.msg_type, recv_msg.msg, recv_msg.result);
+       if (strlen(recv_msg.msg) == 0 || strlen(recv_msg.msg) >= MAX_FILEPATH_LEN) {
+               MSAPI_DBG_ERR("msg size is invlid[%d]", strlen(recv_msg.msg));
+               return FALSE;
+       }
+
+       MSAPI_DBG("Completed. msg_type[%d], msg[%.*s], result[%d]", recv_msg.msg_type, MAX_FILEPATH_LEN, recv_msg.msg, recv_msg.result);
 
        if (__media_dcm_check_cancel()) {
                MSAPI_DBG_INFO("Not canceled item. call cb");

diff --git a/lib/media-util-ipc.c b/lib/media-util-ipc.c
index a4726ac..fa3aca2 100755 (executable)
--- a/lib/media-util-ipc.c
+++ b/lib/media-util-ipc.c
@@ -142,7 +142,7 @@ int ms_ipc_send_msg_to_server_tcp(int sockfd, ms_msg_port_type_e port, ms_comm_m
                MSAPI_DBG_STRERROR("write failed");
                return MS_MEDIA_ERR_SOCKET_SEND;
        } else {
-               MSAPI_DBG_SLOG("result[%d] message[%s]", send_msg->result, send_msg->msg);
+               MSAPI_DBG_SLOG("result[%d] message[%.*s]", send_msg->result, MAX_MSG_SIZE, send_msg->msg);
                if (serv_addr != NULL)
                        *serv_addr = addr;
        }
@@ -157,7 +157,7 @@ int ms_ipc_send_msg_to_client_tcp(int sockfd, ms_comm_msg_s *send_msg, struct so
                return MS_MEDIA_ERR_SOCKET_SEND;
        }
 
-       MSAPI_DBG_SLOG("result[%d] message[%s]", send_msg->result, send_msg->msg);
+       MSAPI_DBG_SLOG("result[%d] message[%.*s]", send_msg->result, MAX_MSG_SIZE, send_msg->msg);
 
        return MS_MEDIA_ERR_NONE;
 }
@@ -215,7 +215,7 @@ int ms_ipc_receive_message_tcp(int client_sock, ms_comm_msg_s *recv_msg)
                }
        }
 
-       MSAPI_DBG_SLOG("receive msg from P[%d] T[%d] M[%s]", recv_msg->pid, recv_msg->msg_type, recv_msg->msg);
+       MSAPI_DBG_SLOG("receive msg from P[%d] T[%d] M[%.*s]", recv_msg->pid, recv_msg->msg_type, MAX_MSG_SIZE, recv_msg->msg);
 
        if (strlen(recv_msg->msg) == 0 || strlen(recv_msg->msg) >= MAX_MSG_SIZE) {
                MSAPI_DBG_ERR("IPC message is wrong. message size is %d", strlen(recv_msg->msg));

diff --git a/lib/media-util-register.c b/lib/media-util-register.c
index d6df733..61c7bc5 100755 (executable)
--- a/lib/media-util-register.c
+++ b/lib/media-util-register.c
@@ -89,34 +89,36 @@ gboolean _read_socket(GIOChannel *src, GIOCondition condition, gpointer data)
                MSAPI_DBG_STRERROR("recv failed");
                return FALSE;
        }
+       if (strlen(recv_msg.msg) > 0 && strlen(recv_msg.msg) < MAX_MSG_SIZE) {
+               req_result.complete_path = g_strdup(recv_msg.msg);
+               MSAPI_DBG("complete_path :%s", req_result.complete_path);
+       } else {
+               MSAPI_DBG("The message is invalid!");
+               return FALSE;
+       }
 
        req_result.pid = recv_msg.pid;
        req_result.result = recv_msg.result;
 
-       if (recv_msg.msg_type == MS_MSG_SCANNER_RESULT) {
-               req_result.complete_path = g_strdup(recv_msg.msg);
+       switch (recv_msg.msg_type) {
+       case MS_MSG_SCANNER_RESULT:
                req_result.request_type = MEDIA_DIRECTORY_SCAN;
-               MSAPI_DBG("complete_path :%s", req_result.complete_path);
-       } else if (recv_msg.msg_type == MS_MSG_SCANNER_BULK_RESULT) {
-               req_result.complete_path = g_strdup(recv_msg.msg);
+               break;
+       case MS_MSG_SCANNER_BULK_RESULT:
                req_result.request_type = MEDIA_FILES_REGISTER;
-       } else if (recv_msg.msg_type == MS_MSG_SCANNER_COMPLETE) {
-               req_result.complete_path = g_strdup(recv_msg.msg);
+               break;
+       case MS_MSG_SCANNER_COMPLETE:
                req_result.request_type = MEDIA_REQUEST_SCAN_COMPLETE;
-       } else if (recv_msg.msg_type == MS_MSG_SCANNER_PARTIAL) {
-               req_result.complete_path = g_strdup(recv_msg.msg);
+               break;
+       case MS_MSG_SCANNER_PARTIAL:
                req_result.request_type = MEDIA_REQUEST_SCAN_PARTIAL;
-       } else if (recv_msg.msg_type == MS_MSG_EXTRACTOR_COMPLETE) {
-               req_result.complete_path = g_strdup(recv_msg.msg);
+               break;
+       case MS_MSG_EXTRACTOR_COMPLETE:
                req_result.request_type = MEDIA_REQUEST_EXTRACT_COMPLETE;
-       } else if (recv_msg.msg_type == MS_MSG_RECEIVE_MSG_FAILED) {
-               MSAPI_DBG_ERR("in _read_socket MS_MSG_RECEIVE_MSG_FAILED");
-               if (strlen(recv_msg.msg) == 0 || strlen(recv_msg.msg) >= MAX_MSG_SIZE)
-                       req_result.complete_path = g_strdup(recv_msg.msg);
-
-               req_result.request_type = MEDIA_REQUEST_ERROR_SERVER_RECEIVE_MSG_FAILED;
-       } else {
-               MSAPI_DBG("The message is invalid!");
+               break;
+       default:
+               MSAPI_DBG("Invalid msg_type[%d]", recv_msg.msg_type);
+               MS_SAFE_FREE(req_result.complete_path);
                return FALSE;
        }
 

diff --git a/src/scanner-v2/media-scanner-extract-v2.c b/src/scanner-v2/media-scanner-extract-v2.c
index e4e7461..69e13dd 100755 (executable)
--- a/src/scanner-v2/media-scanner-extract-v2.c
+++ b/src/scanner-v2/media-scanner-extract-v2.c
@@ -202,7 +202,7 @@ gboolean msc_folder_extract_thread(void *data)
                        goto _POWEROFF;
                }
 
-               MS_DBG_WARN("DIRECTORY EXTRACT START [%s %d]", extract_data->msg, extract_data->msg_type);
+               MS_DBG_WARN("DIRECTORY EXTRACT START [%.*s %d]", MAX_MSG_SIZE, extract_data->msg, extract_data->msg_type);
 
                io_err_count = 0;
 
@@ -227,12 +227,12 @@ gboolean msc_folder_extract_thread(void *data)
                        goto NEXT;
                }
 
-               MS_DBG("path : [%s], storage_id : [%s]", extract_data->msg, storage_id);
+               MS_DBG("path : [%.*s], storage_id : [%s]", MAX_MSG_SIZE, extract_data->msg, storage_id);
 
                update_path = g_strdup(extract_data->msg);
 
                if (strlen(storage_id) == 0) {
-                       MS_DBG_ERR("storage_id length is 0. There is no information of your request [%s]", extract_data->msg);
+                       MS_DBG_ERR("storage_id length is 0. There is no information of your request [%.*s]", MAX_MSG_SIZE, extract_data->msg);
                        ret = MS_MEDIA_ERR_INVALID_PARAMETER;
                        goto NEXT;
                }

diff --git a/src/scanner-v2/media-scanner-scan-v2.c b/src/scanner-v2/media-scanner-scan-v2.c
index d865254..acd06c3 100755 (executable)
--- a/src/scanner-v2/media-scanner-scan-v2.c
+++ b/src/scanner-v2/media-scanner-scan-v2.c
@@ -1087,7 +1087,7 @@ gboolean msc_directory_scan_thread(void *data)
                        goto _POWEROFF;
                }
 
-               MS_DBG_WARN("DIRECTORY SCAN START [%s, %d]", scan_data->msg, scan_data->msg_type);
+               MS_DBG_WARN("DIRECTORY SCAN START [%.*s, %d]", MAX_MSG_SIZE, scan_data->msg, scan_data->msg_type);
 
                msc_set_cur_scan_item(scan_data->msg, scan_data->pid);
                g_directory_scan_processing2 = DIR_SCAN_NON_RECURSIVE;
@@ -1122,10 +1122,10 @@ gboolean msc_directory_scan_thread(void *data)
                        goto NEXT;
                }
 
-               MS_DBG("path [%s], storage_id [%s], scan_type [%d]", scan_data->msg, storage_id, scan_type);
+               MS_DBG("path [%.*s], storage_id [%s], scan_type [%d]", MAX_MSG_SIZE, scan_data->msg, storage_id, scan_type);
 
                if (strlen(storage_id) == 0) {
-                       MS_DBG_ERR("storage_id length is 0. There is no information of your request [%s]", scan_data->msg);
+                       MS_DBG_ERR("storage_id length is 0. There is no information of your request [%.*s]", MAX_MSG_SIZE, scan_data->msg);
                        ret = MS_MEDIA_ERR_INVALID_PARAMETER;
                        goto NEXT;
                }
@@ -1143,10 +1143,10 @@ gboolean msc_directory_scan_thread(void *data)
                        if (ms_check_folder_exist(handle, storage_id, scan_data->msg) == MS_MEDIA_ERR_NONE) {
                                /*already exist in media DB*/
                                noti_type = MS_ITEM_UPDATE;
-                               MS_DBG_WARN("[%s] already exist", scan_data->msg);
+                               MS_DBG_WARN("[%.*s] already exist", MAX_MSG_SIZE, scan_data->msg);
                        } else {
                                noti_type = MS_ITEM_INSERT;
-                               MS_DBG_WARN("[%s] new insert path", scan_data->msg);
+                               MS_DBG_WARN("[%.*s] new insert path", MAX_MSG_SIZE, scan_data->msg);
                        }
                } else {
                        /*directory is deleted*/
@@ -1157,7 +1157,7 @@ gboolean msc_directory_scan_thread(void *data)
                        /*get the UUID of deleted folder*/
                        ms_get_folder_id(handle, storage_id, scan_data->msg, &folder_uuid);
 
-                       MS_DBG_WARN("[%s][%s] delete path", scan_data->msg, folder_uuid);
+                       MS_DBG_WARN("[%.*s][%s] delete path", MAX_MSG_SIZE, scan_data->msg, folder_uuid);
                }
 
                if (scan_type == MS_MSG_DIRECTORY_SCANNING) {
@@ -1168,7 +1168,7 @@ gboolean msc_directory_scan_thread(void *data)
                        err = __msc_check_scan_same_path(scan_data->msg);
 
                        if (MS_MEDIA_ERR_NONE == err) {
-                               MS_DBG_WARN("[%s] is scanning recursive, waiting...", scan_data->msg);
+                               MS_DBG_WARN("[%.*s] is scanning recursive, waiting...", MAX_MSG_SIZE, scan_data->msg);
 
                                while (1) {
                                        sleep(1);
@@ -1183,7 +1183,7 @@ gboolean msc_directory_scan_thread(void *data)
                                                break;
                                }
 
-                               MS_DBG_WARN("[%s] scan done, wait finished", scan_data->msg);
+                               MS_DBG_WARN("[%.*s] scan done, wait finished", MAX_MSG_SIZE, scan_data->msg);
                                goto SCAN_DONE;
 
                        } else {
@@ -1201,18 +1201,18 @@ gboolean msc_directory_scan_thread(void *data)
                        ms_check_folder_modified(handle, scan_data->msg, storage_id, &modified);
 
                        if (modified == FALSE) {
-                               MS_DBG_WARN("check [%s] has not been modified !!", scan_data->msg);
+                               MS_DBG_WARN("check [%.*s] has not been modified !!", MAX_MSG_SIZE, scan_data->msg);
                                ms_get_folder_scan_status(handle, storage_id, scan_data->msg, (int*)&scan_status);
                                MS_DBG_WARN("folder scan status = [%d]", scan_status);
 
                                if (scan_status == MS_DIR_SCAN_DONE) {
                                        /* do nothing */
-                                       MS_DBG_WARN("[%s] scan done", scan_data->msg);
+                                       MS_DBG_WARN("[%.*s] scan done", MAX_MSG_SIZE, scan_data->msg);
                                        /*fix timing issue, deleted items scanned by storage scan is set validity 1 again*/
                                        /*err = ms_set_folder_item_validity(handle, storage_id, scan_data->msg, MS_VALIND, MS_NON_RECURSIVE, uid);*/
                                        goto SCAN_DONE;
                                } else if (scan_status == MS_DIR_SCAN_PROCESSING) {
-                                       MS_DBG_WARN("[%s] scanning, waiting...", scan_data->msg);
+                                       MS_DBG_WARN("[%.*s] scanning, waiting...", MAX_MSG_SIZE, scan_data->msg);
 
                                        while (1) {
                                                sleep(1);
@@ -1224,13 +1224,13 @@ gboolean msc_directory_scan_thread(void *data)
 
                                                ms_get_folder_scan_status(handle, storage_id, scan_data->msg, (int*)&scan_status);
                                                if ((scan_status == MS_DIR_SCAN_DONE) || (scan_status == MS_DIR_SCAN_STOP)) {
-                                                       MS_DBG_WARN("[%s] scan status [%d]!!!", scan_data->msg, scan_status);
+                                                       MS_DBG_WARN("[%.*s] scan status [%d]!!!", MAX_MSG_SIZE, scan_data->msg, scan_status);
                                                        break;
                                                }
                                        }
 
                                        if (scan_status == MS_DIR_SCAN_DONE) {
-                                               MS_DBG_WARN("[%s] scan done, wait finished", scan_data->msg);
+                                               MS_DBG_WARN("[%.*s] scan done, wait finished", MAX_MSG_SIZE, scan_data->msg);
                                                goto SCAN_DONE;
                                        } else {
                                                MS_DBG_WARN("set folder item invalid");
@@ -1240,7 +1240,7 @@ gboolean msc_directory_scan_thread(void *data)
                                        err = ms_set_folder_item_validity(handle, storage_id, scan_data->msg, MS_INVALID, MS_NON_RECURSIVE, uid);
                                }
                        } else {
-                               MS_DBG_WARN("check [%s] has been modified !!", scan_data->msg);
+                               MS_DBG_WARN("check [%.*s] has been modified !!", MAX_MSG_SIZE, scan_data->msg);
                                err = ms_set_folder_item_validity(handle, storage_id, scan_data->msg, MS_INVALID, MS_NON_RECURSIVE, uid);
                        }
                }
@@ -1262,7 +1262,7 @@ gboolean msc_directory_scan_thread(void *data)
                /*call for bundle commit*/
                ms_bacth_commit_disable(handle, TRUE, TRUE, uid);
 
-               MS_DBG_WARN("folder scan done, sent cb event path = [%s]", scan_data->msg);
+               MS_DBG_WARN("folder scan done, sent cb event path = [%.*s]", MAX_MSG_SIZE, scan_data->msg);
                __msc_call_dir_scan_cb();
 
                /*delete invalid folder first, then delete invalid item, avoid to folder was deleted but item not when unmount*/
@@ -1277,7 +1277,7 @@ gboolean msc_directory_scan_thread(void *data)
                }*/
 
 SCAN_DONE:
-               MS_DBG_WARN("storage_id = [%s], dir Path = [%s], pid = [%d]", storage_id, scan_data->msg, scan_data->pid);
+               MS_DBG_WARN("storage_id = [%s], dir Path = [%.*s], pid = [%d]", storage_id, MAX_MSG_SIZE, scan_data->msg, scan_data->pid);
                if (ret != MS_MEDIA_ERR_SCANNER_FORCE_STOP) {
                        if (noti_type == MS_ITEM_DELETE) {
                                ms_send_dir_update_noti(handle, storage_id, scan_data->msg, folder_uuid, noti_type, scan_data->pid);
@@ -1367,7 +1367,7 @@ gboolean msc_storage_scan_thread(void *data)
                        goto _POWEROFF;
                }
 
-               MS_DBG_WARN("STORAGE SCAN START [%s]", scan_data->msg);
+               MS_DBG_WARN("STORAGE SCAN START [%.*s]", MAX_MSG_SIZE, scan_data->msg);
 
                scan_type = scan_data->msg_type;
                if (scan_type != MS_MSG_STORAGE_ALL
@@ -1495,7 +1495,7 @@ _POWEROFF:
 
 static void __msc_insert_register_request(GArray *register_array, ms_comm_msg_s *insert_data)
 {
-       MS_DBG_SLOG("path : %s", insert_data->msg);
+       MS_DBG_SLOG("path : %.*s", MAX_MSG_SIZE, insert_data->msg);
 
        if (insert_data->pid == POWEROFF)
                g_array_prepend_val(register_array, insert_data);
@@ -1666,7 +1666,7 @@ static int __msc_pop_register_request(GArray *register_array, ms_comm_msg_s **re
                }
        }
 
-       if ((strlen((*register_data)->msg) <= 0) || (strlen((*register_data)->msg) > MS_FILE_PATH_LEN_MAX)) {
+       if ((strlen((*register_data)->msg) <= 0) || (strlen((*register_data)->msg) >= MS_FILE_PATH_LEN_MAX)) {
                MS_DBG_ERR("message size[%d] is wrong", strlen((*register_data)->msg));
                return MS_MEDIA_ERR_INVALID_IPC_MESSAGE;
        }
@@ -1741,7 +1741,7 @@ FREE_RESOURCE:
                /* If register_files operation is stopped, there is no necessrty for sending result. */
                msc_send_result(ret, register_data);
 
-               MS_DBG_WARN("BULK REGISTER END [%d |%s]", ret, register_data->msg);
+               MS_DBG_WARN("BULK REGISTER END [%d |%.*s]", ret, MAX_MSG_SIZE, register_data->msg);
 
                __msc_clear_file_list(path_array);
 

diff --git a/src/scanner-v2/media-scanner-socket-v2.c b/src/scanner-v2/media-scanner-socket-v2.c
index 1c99f7b..900582a 100755 (executable)
--- a/src/scanner-v2/media-scanner-socket-v2.c
+++ b/src/scanner-v2/media-scanner-socket-v2.c
@@ -70,7 +70,7 @@ static int _msc_remove_request(GAsyncQueue *req_queue, ms_comm_msg_s *recv_msg)
                for (i = 0; i < len; i++) {
                        /*create new queue to compare request*/
                        msg = g_async_queue_pop(scan_queue2);
-                       MS_DBG_WARN("msg->msg[%s], msg->pid[%d]", msg->msg, msg->pid);
+                       MS_DBG_WARN("msg->msg[%.*s], msg->pid[%d]", MAX_MSG_SIZE, msg->msg, msg->pid);
                        if ((strcmp(msg->msg, cancel_path) == 0) && (pid == msg->pid)) {
                                msg->msg_type = MS_MSG_DIRECTORY_SCANNING_CANCEL;
                                msc_send_result(MS_MEDIA_ERR_SCANNER_FORCE_STOP, msg);
@@ -161,7 +161,17 @@ gboolean msc_receive_request(GIOChannel *src, GIOCondition condition, gpointer d
                return MS_MEDIA_ERR_FILE_READ_FAIL;
        }
 
-       MS_DBG_SLOG("receive msg from [%d] %d, %s", recv_msg->pid, recv_msg->msg_type, recv_msg->msg);
+       if (strlen(recv_msg->msg) == 0 || strlen(recv_msg->msg) >= MAX_MSG_SIZE) {
+               MS_DBG_ERR("msg size is invlid[%d]", strlen(recv_msg->msg));
+               return TRUE;
+       }
+
+       if (strlen(recv_msg->storage_id) >= MS_UUID_SIZE) {
+               MS_DBG_ERR("storage_id size is invlid[%d]", strlen(recv_msg->storage_id));
+               return TRUE;
+       }
+
+       MS_DBG_SLOG("receive msg from [%d][%d] M[%.*s] S[%.*s]", recv_msg->pid, recv_msg->msg_type, MAX_MSG_SIZE, recv_msg->msg, MS_UUID_SIZE, recv_msg->storage_id);
 
        /* copy from recived data */
        req_num = recv_msg->msg_type;

diff --git a/src/scanner/media-scanner-scan.c b/src/scanner/media-scanner-scan.c
index 0bd84e7..c3f1443 100755 (executable)
--- a/src/scanner/media-scanner-scan.c
+++ b/src/scanner/media-scanner-scan.c
@@ -216,7 +216,7 @@ gboolean msc_directory_scan_thread(void *data)
                        goto _POWEROFF;
                }
 
-               MS_DBG_WARN("DIRECTORY SCAN START [%s %d]", scan_data->msg, scan_data->msg_type);
+               MS_DBG_WARN("DIRECTORY SCAN START [%.*s %d]", MAX_MSG_SIZE, scan_data->msg, scan_data->msg_type);
 
                ret = ms_connect_db(&handle, scan_data->uid);
                if (ret != MS_MEDIA_ERR_NONE) {
@@ -234,12 +234,12 @@ gboolean msc_directory_scan_thread(void *data)
                                goto NEXT;
                        }
                } else {
-                       MS_DBG_ERR("storage_id length is 0. There is no information of your request [%s]", scan_data->msg);
+                       MS_DBG_ERR("storage_id length is 0. There is no information of your request [%.*s]", MAX_MSG_SIZE, scan_data->msg);
                        ret = MS_MEDIA_ERR_INVALID_PARAMETER;
                        goto NEXT;
                }
 
-               MS_DBG("path : [%s], storage_id : [%s]", scan_data->msg, storage_id);
+               MS_DBG("path : [%.*s], storage_id : [%s]", MAX_MSG_SIZE, scan_data->msg, storage_id);
 
                if (scan_type != MS_MSG_DIRECTORY_SCANNING && scan_type != MS_MSG_DIRECTORY_SCANNING_NON_RECURSIVE) {
                        MS_DBG_ERR("Invalid request");
@@ -255,10 +255,10 @@ gboolean msc_directory_scan_thread(void *data)
                        if (ms_check_folder_exist(handle, storage_id, scan_data->msg) == MS_MEDIA_ERR_NONE) {
                                /*already exist in media DB*/
                                noti_type = MS_ITEM_UPDATE;
-                               MS_DBG_WARN("[%s] already exist", scan_data->msg);
+                               MS_DBG_WARN("[%.*s] already exist", MAX_MSG_SIZE, scan_data->msg);
                        } else {
                                noti_type = MS_ITEM_INSERT;
-                               MS_DBG_WARN("[%s] new insert path", scan_data->msg);
+                               MS_DBG_WARN("[%.*s] new insert path", MAX_MSG_SIZE, scan_data->msg);
                        }
                } else {
                        /*directory is deleted*/
@@ -268,7 +268,7 @@ gboolean msc_directory_scan_thread(void *data)
                        /*get the UUID of deleted folder*/
                        ms_get_folder_id(handle, storage_id, scan_data->msg, &folder_uuid);
 
-                       MS_DBG_WARN("[%s][%s] delete path", scan_data->msg, folder_uuid);
+                       MS_DBG_WARN("[%.*s][%s] delete path", MAX_MSG_SIZE, scan_data->msg, folder_uuid);
                }
 
                if (noti_type != MS_ITEM_INSERT) {
@@ -364,7 +364,7 @@ gboolean msc_storage_scan_thread(void *data)
                        goto _POWEROFF;
                }
 
-               MS_DBG_WARN("STORAGE SCAN START [%s][%s]", scan_data->msg, scan_data->storage_id);
+               MS_DBG_WARN("STORAGE SCAN START [%.*s][%s]", MAX_MSG_SIZE, scan_data->msg, scan_data->storage_id);
 
                scan_type = scan_data->msg_type;
                if (scan_type != MS_MSG_STORAGE_ALL
@@ -396,7 +396,7 @@ gboolean msc_storage_scan_thread(void *data)
                                goto NEXT;
                        }
                } else {
-                       MS_DBG_ERR("storage_id length is 0. There is no information of your request [%s]", scan_data->msg);
+                       MS_DBG_ERR("storage_id length is 0. There is no information of your request [%.*s]", MAX_MSG_SIZE, scan_data->msg);
                        ret = MS_MEDIA_ERR_INVALID_PARAMETER;
                        goto NEXT;
                }
@@ -468,7 +468,7 @@ _POWEROFF:
 
 static void __msc_insert_register_request(GArray *register_array, ms_comm_msg_s *insert_data)
 {
-       MS_DBG_SLOG("path : %s", insert_data->msg);
+       MS_DBG_SLOG("path : %.*s", MAX_MSG_SIZE, insert_data->msg);
 
        if (insert_data->pid == POWEROFF)
                g_array_prepend_val(register_array, insert_data);
@@ -635,7 +635,7 @@ static int __msc_pop_register_request(GArray *register_array, ms_comm_msg_s **re
                }
        }
 
-       if ((strlen((*register_data)->msg) <= 0) || (strlen((*register_data)->msg) > MS_FILE_PATH_LEN_MAX)) {
+       if ((strlen((*register_data)->msg) <= 0) || (strlen((*register_data)->msg) >= MS_FILE_PATH_LEN_MAX)) {
                MS_DBG_ERR("message size[%d] is wrong", strlen((*register_data)->msg));
                return MS_MEDIA_ERR_INVALID_IPC_MESSAGE;
        }
@@ -708,7 +708,7 @@ FREE_RESOURCE:
                /* If register_files operation is stopped, there is no necessrty for sending result. */
                msc_send_result(ret, register_data);
 
-               MS_DBG_WARN("BULK REGISTER END [%d |%s]", ret, register_data->msg);
+               MS_DBG_WARN("BULK REGISTER END [%d |%.*s]", ret, MAX_MSG_SIZE, register_data->msg);
 
                __msc_clear_file_list(path_array);
 

diff --git a/src/scanner/media-scanner-socket.c b/src/scanner/media-scanner-socket.c
index 0d7a06c..cc13b1d 100755 (executable)
--- a/src/scanner/media-scanner-socket.c
+++ b/src/scanner/media-scanner-socket.c
@@ -60,7 +60,17 @@ gboolean msc_receive_request(GIOChannel *src, GIOCondition condition, gpointer d
                return MS_MEDIA_ERR_FILE_READ_FAIL;
        }
 
-       MS_DBG_SLOG("receive msg from [%d] %d, %s", recv_msg->pid, recv_msg->msg_type, recv_msg->msg);
+       if (strlen(recv_msg->msg) == 0 || strlen(recv_msg->msg) >= MAX_MSG_SIZE) {
+               MS_DBG_ERR("msg size is invlid[%d]", strlen(recv_msg->msg));
+               return TRUE;
+       }
+
+       if (strlen(recv_msg->storage_id) >= MS_UUID_SIZE) {
+               MS_DBG_ERR("storage_id size is invlid[%d]", strlen(recv_msg->storage_id));
+               return TRUE;
+       }
+
+       MS_DBG_SLOG("receive msg from [%d][%d] M[%.*s] S[%.*s]", recv_msg->pid, recv_msg->msg_type, MAX_MSG_SIZE, recv_msg->msg, MS_UUID_SIZE, recv_msg->storage_id);
 
        /* copy from recived data */
        req_num = recv_msg->msg_type;

diff --git a/src/server/media-server-dcm.c b/src/server/media-server-dcm.c
index 0eaee7b..6d67987 100755 (executable)
--- a/src/server/media-server-dcm.c
+++ b/src/server/media-server-dcm.c
@@ -118,6 +118,11 @@ int __ms_dcm_recv_msg(int sock, dcmMsg *msg)
        }
        memcpy(msg, buf, sizeof(dcmMsg));
 
+       if (strlen(msg->msg) >= MAX_FILEPATH_LEN) {
+               MS_DBG_ERR("msg size is invlid[%d]", strlen(msg->msg));
+               return MS_MEDIA_ERR_INVALID_IPC_MESSAGE;
+       }
+
        MS_SAFE_FREE(buf);
 
        MS_DBG("msg_type [%d]", msg->msg_type);
@@ -207,7 +212,7 @@ gboolean _ms_dcm_agent_send_msg_to_dcm_server(dcmMsg *recv_msg, dcmMsg *res_msg)
        struct sockaddr_un serv_addr;
        int send_str_len = strlen(recv_msg->msg);
 
-       if (send_str_len > MAX_FILEPATH_LEN) {
+       if (send_str_len >= MAX_FILEPATH_LEN) {
                MS_DBG_ERR("original path's length exceeds %d(max packet size)", MAX_FILEPATH_LEN);
                return FALSE;
        }
@@ -244,7 +249,7 @@ gboolean _ms_dcm_agent_send_msg_to_dcm_server(dcmMsg *recv_msg, dcmMsg *res_msg)
                return FALSE;
        }
 
-       MS_DBG_SLOG("recv %s(%d, %d) from DCM daemon is successful", res_msg->msg, res_msg->msg_type, res_msg->result);
+       MS_DBG_SLOG("recv %.*s(%d, %d) from DCM daemon is successful", MAX_FILEPATH_LEN, res_msg->msg, res_msg->msg_type, res_msg->result);
        close(sock);
 
        return TRUE;
@@ -355,7 +360,7 @@ gboolean _ms_dcm_request_to_server(gpointer data)
                        if (send(client_sock, &res_msg, sizeof(res_msg), 0) != sizeof(res_msg))
                                MS_DBG_STRERROR("sendto failed");
                        else
-                               MS_DBG("Sent Refuse msg from %s", recv_msg->msg);
+                               MS_DBG("Sent Refuse msg from %.*s", MAX_FILEPATH_LEN, recv_msg->msg);
 
                        close(client_sock);
 
@@ -447,7 +452,7 @@ gboolean _ms_dcm_agent_read_socket(GIOChannel *src, GIOCondition condition, gpoi
                if (send(client_sock, &res_msg, sizeof(dcmMsg), 0) != sizeof(dcmMsg))
                        MS_DBG_STRERROR("sendto failed");
                else
-                       MS_DBG("Sent Refuse msg from %s", recv_msg->msg);
+                       MS_DBG("Sent Refuse msg from %.*s", MAX_FILEPATH_LEN, recv_msg->msg);
 
                close(client_sock);
                MS_SAFE_FREE(dcm_req->recv_msg);
@@ -456,7 +461,7 @@ gboolean _ms_dcm_agent_read_socket(GIOChannel *src, GIOCondition condition, gpoi
                return TRUE;
        }
 
-       MS_DBG_SLOG("[%s] is queued", recv_msg->msg);
+       MS_DBG_SLOG("[%.*s] is queued", MAX_FILEPATH_LEN, recv_msg->msg);
        g_queue_push_tail(g_dcm_request_queue, (gpointer)dcm_req);
 
        if (!g_dcm_queue_work) {

diff --git a/src/server/media-server-socket.c b/src/server/media-server-socket.c
index e23342c..f90e16f 100755 (executable)
--- a/src/server/media-server-socket.c
+++ b/src/server/media-server-socket.c
@@ -370,9 +370,6 @@ ERROR:
                case MS_MSG_BURSTSHOT_INSERT:
                        res_msg.msg_type = MS_MSG_SCANNER_BULK_RESULT;
                        break;
-               case MS_MSG_RECEIVE_MSG_FAILED:
-                       res_msg.msg_type = MS_MSG_RECEIVE_MSG_FAILED;
-                       break;
                case MS_MSG_MEDIA_DB_MALFORMED:
                        res_msg.msg_type = MS_MSG_MEDIA_DB_MALFORMED;
                        break;
@@ -493,7 +490,6 @@ int ms_send_storage_scan_request(const char *root_path, const char *storage_id,
                break;
        }
 
-       /* msg_size & msg */
        if (root_path != NULL)
                SAFE_STRLCPY(scan_msg.msg, root_path, sizeof(scan_msg.msg));
 
@@ -865,7 +861,17 @@ gboolean ms_receive_message_from_scanner(GIOChannel *src, GIOCondition condition
                return MS_MEDIA_ERR_FILE_READ_FAIL;
        }
 
-       MS_DBG_SLOG("receive result from scanner [%d] %d, %s", recv_msg.pid, recv_msg.result, recv_msg.msg);
+       if (strlen(recv_msg.msg) == 0 || strlen(recv_msg.msg) >= MAX_MSG_SIZE) {
+               MS_DBG_ERR("msg size is invlid[%d]", strlen(recv_msg.msg));
+               return TRUE;
+       }
+
+       if (strlen(recv_msg.storage_id) >= MS_UUID_SIZE) {
+               MS_DBG_ERR("storage_id size is invlid[%d]", strlen(recv_msg.storage_id));
+               return TRUE;
+       }
+
+       MS_DBG_SLOG("receive result from scanner [%d][%d] M[%.*s] S[%.*s]", recv_msg.pid, recv_msg.result, MAX_MSG_SIZE, recv_msg.msg, MS_UUID_SIZE, recv_msg.storage_id);
 
        msg_type = recv_msg.msg_type;
        pid = recv_msg.pid;
@@ -961,7 +967,6 @@ int ms_send_storage_otg_scan_request(const char *path, const char *device_uuid,
                break;
        }
 
-       /* msg_size & msg */
        SAFE_STRLCPY(scan_msg.msg, path, sizeof(scan_msg.msg));
        SAFE_STRLCPY(scan_msg.storage_id, device_uuid, sizeof(scan_msg.storage_id));
 

diff --git a/src/server/media-server-thumb.c b/src/server/media-server-thumb.c
index 1e1dd37..3a21ab7 100755 (executable)
--- a/src/server/media-server-thumb.c
+++ b/src/server/media-server-thumb.c
@@ -140,14 +140,14 @@ int _ms_thumb_recv_msg(int sock, thumbMsg *msg)
                return MS_MEDIA_ERR_NONE;
        }
 
-       if (strlen(msg->org_path) == 0 || strlen(msg->org_path) > MS_FILE_PATH_LEN_MAX) {
+       if (strlen(msg->org_path) == 0 || strlen(msg->org_path) >= MS_FILE_PATH_LEN_MAX) {
                MS_DBG_ERR("org_path size is invalid %d", strlen(msg->org_path));
 
                return MS_MEDIA_ERR_DATA_TAINTED;
        }
 
        /* it can be empty string */
-       if (strlen(msg->dst_path) > MS_FILE_PATH_LEN_MAX) {
+       if (strlen(msg->dst_path) >= MS_FILE_PATH_LEN_MAX) {
                MS_DBG_ERR("dst_path size is invalid %d", strlen(msg->dst_path));
 
                return MS_MEDIA_ERR_DATA_TAINTED;
@@ -304,7 +304,7 @@ gboolean _ms_thumb_agent_send_msg_to_thumb_server(thumbMsg *recv_msg, thumbMsg *
        struct sockaddr_un serv_addr;
        int send_str_len = strlen(recv_msg->org_path);
 
-       if (send_str_len > MAX_FILEPATH_LEN) {
+       if (send_str_len >= MAX_FILEPATH_LEN) {
                MS_DBG_ERR("original path's length exceeds %d(max packet size)", MAX_FILEPATH_LEN);
                return FALSE;
        }