bug fix: Modify buffer overflow

Change-Id: Ice0433d25c4f9c5aa0f8a9d522afcce46320d37b
Signed-off-by: Seonah Moon <seonah1.moon@samsung.com>

diff --git a/oma-parser/oma-parser-dd1.c b/oma-parser/oma-parser-dd1.c
index 9f2f55d..7a11c99 100644 (file)
--- a/oma-parser/oma-parser-dd1.c
+++ b/oma-parser/oma-parser-dd1.c
@@ -24,8 +24,7 @@
 
 #include "oma-parser-dd1.h"
 
-static dd1_Element_Info_table dd_element_table[DD_ELEMENT_COUNT_MAX] =
-{
+static dd1_Element_Info_table dd_element_table[DD_ELEMENT_COUNT_MAX] = {
        {"type",                DD1_ELEMENT_TYPE,       -1},    /*Mandatory */
        {"size",                DD1_ELEMENT_SIZE,       -1},    /*Mandatory */
        {"objectURI",           DD1_ELEMENT_URL,        -1},    /*Mandatory */
@@ -51,17 +50,17 @@ static dd1_Element_Info_table dd_element_table[DD_ELEMENT_COUNT_MAX] =
 /* Warnings / Errors Logging Functions */
 static void op_parse_warning(void *userData, const char *msg, ...)
 {
-    OP_LOGD("Warning : %s", msg);
+       OP_LOGD("Warning : %s", msg);
 }
 
 static void op_parse_error(void *userData, const char *msg, ...)
 {
-    OP_LOGE("Error: %s", msg);
+       OP_LOGE("Error: %s", msg);
 }
 
 static void op_parse_fatal_error(void *userData, const char *msg, ...)
 {
-    OP_LOGE("Fatal Error : %s", msg);
+       OP_LOGE("Fatal Error : %s", msg);
 }
 
 int op_parse_dd1_file(xmlSAXHandler *sHandlerPtr, op_parser_app_data_t **app_data)
@@ -74,7 +73,7 @@ int op_parse_dd1_file(xmlSAXHandler *sHandlerPtr, op_parser_app_data_t **app_dat
        OP_LOGD("");
 
        app_data_local = (op_parser_app_data_t *)calloc(1,
-               sizeof(op_parser_app_data_t));
+                       sizeof(op_parser_app_data_t));
        if (OP_NULL == app_data) {
                OP_LOGE("MEMORY ALLOCATION FAIL");
                ret = OP_ERR_FAIL_TO_MEMALLOC;
@@ -197,9 +196,9 @@ int op_check_dd1_mandatory_tags(op_parser_app_data_t *app_data)
 }
 
 void op_libxml_start_element_dd1(
-        void *userData,
-        const xmlChar *name,
-        const xmlChar **atts)
+               void *userData,
+               const xmlChar *name,
+               const xmlChar **atts)
 {
        op_parser_app_data_t *app_data = OP_NULL;
        int index = 0;
@@ -218,11 +217,11 @@ void op_libxml_start_element_dd1(
 
        for (index = 0; index < DD_ELEMENT_COUNT_MAX; index++) {
                if (0 == xmlStrcmp(name,
-                       (const xmlChar *)(dd_element_table[index].element_str))) {
+                                       (const xmlChar *)(dd_element_table[index].element_str))) {
                        OP_LOGD("Element matches with listed's. Index[%d]",
                                        dd_element_table[index].element_index);
                        app_data->element_index
-                               = dd_element_table[index].element_index;
+                               = dd_element_table[index].element_index;
                        OPEN_ELEMENT(app_data->element_index);
                        break;
                }
@@ -256,10 +255,10 @@ void op_libxml_end_element_dd1(void *userData, const xmlChar *name)
 
        for (index = 0; index < DD_ELEMENT_COUNT_MAX; index++) {
                if (0 == xmlStrcmp(name,
-                       (const xmlChar *)(dd_element_table[index].element_str))) {
+                                       (const xmlChar *)(dd_element_table[index].element_str))) {
                        if (!IS_ELEMENT_OPEN(index)) {
                                app_data->parseError
-                                       = OP_PARSER_ERR_INTERNAL_PARSING;
+                                       = OP_PARSER_ERR_INTERNAL_PARSING;
                                OP_LOGE("End Element Does not match with the start element");
                                goto ERR;
                        }
@@ -297,9 +296,8 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                goto ERR;
        }
 
-       if (len <= 0) {
+       if (len <= 0)
                goto ERR;
-       }
 
        ch_str = (char *)calloc(1, len + 1);
        if (OP_NULL == ch_str) {
@@ -311,11 +309,11 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
        if (app_data->element_index >= 0) {
                OP_LOGD("app_data->parseError[%d], app_data->element_index[%d], \
                                dd_element_table[app_data->element_index].isTagOpen[%d]",
-                               app_data->parseError,app_data->element_index,
+                               app_data->parseError, app_data->element_index,
                                IS_ELEMENT_OPEN(app_data->element_index));
        } else {
                OP_LOGD("app_data->parseError[%d], app_data->element_index[%d]",
-                               app_data->parseError,app_data->element_index);
+                               app_data->parseError, app_data->element_index);
        }
        if ((OP_RESULT_OK == app_data->parseError) &&
                (app_data->element_index != DD1_ELEMENT_NONE) &&
@@ -328,35 +326,33 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                        op_com_util_remove_blankspace(ch_str, len);
                        if ((dd_info->type)[0] == 0) {
                                if ((app_data->element_index)
-                                       < DD_ELEMENT_MANOPT_COUNT) {
+                                               < DD_ELEMENT_MANOPT_COUNT) {
                                        cntxt->bMand_element_registrar[app_data->element_index]
-                                               = OP_TRUE;
+                                               = OP_TRUE;
                                } else {
                                        OP_LOGE("Element Index[%d] is not in Mandatory List",
                                                        app_data->element_index);
                                        app_data->parseError
-                                               = OP_PARSER_ERR_INTERNAL_PARSING;
+                                               = OP_PARSER_ERR_INTERNAL_PARSING;
                                        goto ERR;
                                }
 
                                strncpy(dd_info->type, ch_str,
-                                       OP_MAX_MIME_STR_LEN - 1);
+                                               OP_MAX_MIME_STR_LEN - 1);
                                dd_info->type[OP_MAX_MIME_STR_LEN - 1] = '\0';
                                OP_SLOG("dd_info->type:[%s]", dd_info->type);
                        } else {
                                more_type_info_t *temp_type = OP_NULL;
 
                                temp_type = (more_type_info_t *)calloc(1,
-                                       sizeof(more_type_info_t));
+                                               sizeof(more_type_info_t));
                                if (temp_type == OP_NULL) {
-                                       app_data->parseError
-                                               = OP_ERR_FAIL_TO_MEMALLOC;
+                                       app_data->parseError = OP_ERR_FAIL_TO_MEMALLOC;
                                        goto ERR;
                                }
 
                                temp_type->next = OP_NULL;
-                               strncpy((char*)(temp_type->type), ch_str,
-                                       OP_MAX_MIME_STR_LEN - 1);
+                               strncpy((char*)(temp_type->type), ch_str, OP_MAX_MIME_STR_LEN - 1);
                                temp_type->type[OP_MAX_MIME_STR_LEN - 1] = '\0';
                                OP_SLOG("dd_infoerror:->type[other]:[%s]", temp_type->type);
 
@@ -366,9 +362,9 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                                        more_type_info_t *Cur_Type = OP_NULL;
                                        Cur_Type = dd_info->other_type_info;
 
-                                       while (Cur_Type->next) {
+                                       while (Cur_Type->next)
                                                Cur_Type = Cur_Type->next;
-                                       }
+
                                        Cur_Type->next = temp_type;
                                }
 
@@ -378,13 +374,11 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
 
                case DD1_ELEMENT_SIZE:
                        if (app_data->element_index < DD_ELEMENT_MANOPT_COUNT) {
-                               cntxt->bMand_element_registrar[app_data->element_index]
-                                       = OP_TRUE;
+                               cntxt->bMand_element_registrar[app_data->element_index] = OP_TRUE;
                        } else {
                                OP_LOGE("Element Index[%d] is not in Mandatory List",
                                                app_data->element_index);
-                               app_data->parseError
-                                       = OP_PARSER_ERR_INTERNAL_PARSING;
+                               app_data->parseError = OP_PARSER_ERR_INTERNAL_PARSING;
                                goto ERR;
                        }
 
@@ -403,25 +397,22 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
 
                case DD1_ELEMENT_URL:
                        if (app_data->element_index < DD_ELEMENT_MANOPT_COUNT) {
-                               cntxt->bMand_element_registrar[app_data->element_index]
-                                       = OP_TRUE;
+                               cntxt->bMand_element_registrar[app_data->element_index] = OP_TRUE;
                        } else {
                                OP_LOGE("Element Index [%d] is not in Mandatory List",
                                                app_data->element_index);
-                               app_data->parseError
-                                       = OP_PARSER_ERR_INTERNAL_PARSING;
+                               app_data->parseError = OP_PARSER_ERR_INTERNAL_PARSING;
                                goto ERR;
                        }
 
                        op_com_util_remove_blankspace(ch_str, len);
                        op_com_utils_convert_amp_string(ch_str);
                        if ('\0' == dd_info->object_uri[0]) {
-                               snprintf(dd_info->object_uri, OP_MAX_URI_LEN,
-                                       "%s", ch_str);
+                               snprintf(dd_info->object_uri, OP_MAX_URI_LEN, "%s", ch_str);
                        } else if (IS_ELEMENT_CONTINUING(app_data->element_index)) {
                                strncat(dd_info->object_uri, ch_str,
-                                       OP_MAX_URI_LEN - strlen(
-                                               dd_info->object_uri));
+                                               OP_MAX_URI_LEN - strlen(
+                                                       dd_info->object_uri) - 1);
                        }
 
                        OP_SLOG("dd_info->object_uri:[%s]", dd_info->object_uri);
@@ -431,7 +422,7 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                case DD1_ELEMENT_NAME:
                        if (IS_ELEMENT_CONTINUING(app_data->element_index)) {
                                strncat(dd_info->name, ch_str, OP_MAX_URI_LEN
-                                       - strlen(dd_info->name));
+                                               - strlen(dd_info->name) - 1);
                        } else if (strlen(ch_str) < OP_MAX_STR_LEN) {
                                strncpy(dd_info->name, ch_str, strlen(ch_str));
                        }
@@ -443,10 +434,10 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                case DD1_ELEMENT_DDVERSION:
                        op_com_util_remove_blankspace(ch_str, len);
                        if (op_com_util_resolve_version(ch_str,
-                               &(dd_info->major_version),
-                               &(dd_info->minor_version), OP_NULL)
-                               != OP_RESULT_OK)
-                                       OP_LOGE("Version Resolution Error");
+                                               &(dd_info->major_version),
+                                               &(dd_info->minor_version), OP_NULL)
+                                       != OP_RESULT_OK)
+                               OP_LOGE("Version Resolution Error");
 
                        OP_SLOG("major_version:[%d],minor_version:[%d]",
                                        dd_info->major_version, dd_info->minor_version);
@@ -456,18 +447,15 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                case DD1_ELEMENT_VENDOR:
                        if (IS_ELEMENT_CONTINUING(app_data->element_index)) {
                                char *temp = NULL;
-                               temp = op_com_utils_concat(dd_info->vendor,
-                                       ch_str);
+                               temp = op_com_utils_concat(dd_info->vendor, ch_str);
                                if (temp) {
                                        free(dd_info->vendor);
                                        dd_info->vendor = temp;
                                }
                        } else {
-                               dd_info->vendor = (char*)calloc(1, strlen(
-                                       ch_str) + 1);
+                               dd_info->vendor = (char*)calloc(1, strlen(ch_str) + 1);
                                if (OP_NULL == dd_info->vendor) {
-                                       app_data->parseError
-                                               = OP_ERR_FAIL_TO_MEMALLOC;
+                                       app_data->parseError = OP_ERR_FAIL_TO_MEMALLOC;
                                        goto ERR;
                                }
                                strncpy(dd_info->vendor, ch_str, strlen(ch_str));
@@ -482,22 +470,20 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                        op_com_utils_convert_amp_string(ch_str);
                        if (IS_ELEMENT_CONTINUING(app_data->element_index)) {
                                char *temp = NULL;
-                               temp = op_com_utils_concat(
-                                       dd_info->install_notify_uri, ch_str);
+                               temp = op_com_utils_concat(dd_info->install_notify_uri, ch_str);
                                if (temp) {
                                        free(dd_info->install_notify_uri);
                                        dd_info->install_notify_uri = temp;
                                }
                        } else {
-                               dd_info->install_notify_uri = (char*)calloc(1,
-                                       strlen(ch_str) + 1);
+                               dd_info->install_notify_uri = (char*)calloc(1, strlen(ch_str) + 1);
                                if (OP_NULL == dd_info->install_notify_uri) {
                                        app_data->parseError
-                                               = OP_ERR_FAIL_TO_MEMALLOC;
+                                               = OP_ERR_FAIL_TO_MEMALLOC;
                                        goto ERR;
                                }
                                strncpy(dd_info->install_notify_uri,
-                                       (const char*)ch_str, strlen(ch_str));
+                                               (const char*)ch_str, strlen(ch_str));
                        }
                        OP_SLOG("dd_info->install_notify_uri:[%s]",
                                        dd_info->install_notify_uri);
@@ -508,21 +494,21 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                        if (IS_ELEMENT_CONTINUING(app_data->element_index)) {
                                char *temp = NULL;
                                temp = op_com_utils_concat(
-                                       dd_info->description, ch_str);
+                                       dd_info->description, ch_str);
                                if (temp) {
                                        free(dd_info->description);
                                        dd_info->description = temp;
                                }
                        } else {
                                dd_info->description = (char*)calloc(1, strlen(
-                                       ch_str) + 1);
+                                       ch_str) + 1);
                                if (OP_NULL == dd_info->description) {
                                        app_data->parseError
-                                               = OP_ERR_FAIL_TO_MEMALLOC;
+                                               = OP_ERR_FAIL_TO_MEMALLOC;
                                        goto ERR;
                                }
                                strncpy(dd_info->description,
-                                       (const char*)ch_str, strlen(ch_str));
+                                               (const char*)ch_str, strlen(ch_str));
                        }
                        OP_SLOG("dd_info->description:[%s]",
                                        dd_info->description);
@@ -535,21 +521,21 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                        if (IS_ELEMENT_CONTINUING(app_data->element_index)) {
                                char *temp = NULL;
                                temp = op_com_utils_concat(
-                                       dd_info->midlet_info_url, ch_str);
+                                               dd_info->midlet_info_url, ch_str);
                                if (temp) {
                                        free(dd_info->midlet_info_url);
                                        dd_info->midlet_info_url = temp;
                                }
                        } else {
                                dd_info->midlet_info_url = (char*)calloc(1,
-                                       strlen(ch_str) + 1);
+                                               strlen(ch_str) + 1);
                                if (OP_NULL == dd_info->midlet_info_url) {
                                        app_data->parseError
-                                               = OP_ERR_FAIL_TO_MEMALLOC;
+                                                       = OP_ERR_FAIL_TO_MEMALLOC;
                                        goto ERR;
                                }
                                strncpy(dd_info->midlet_info_url,
-                                       (const char*)ch_str, strlen(ch_str));
+                                               (const char*)ch_str, strlen(ch_str));
                        }
                        OP_SLOG("dd_info->midlet_info_url:[%s]",
                                        dd_info->midlet_info_url);
@@ -562,21 +548,21 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                        if (IS_ELEMENT_CONTINUING(app_data->element_index)) {
                                char *temp = NULL;
                                temp = op_com_utils_concat(dd_info->icon_uri,
-                                       ch_str);
+                                               ch_str);
                                if (temp) {
                                        free(dd_info->icon_uri);
                                        dd_info->icon_uri = temp;
                                }
                        } else {
                                dd_info->icon_uri = (char*)calloc(1, strlen(
-                                       ch_str) + 1);
+                                               ch_str) + 1);
                                if (OP_NULL == dd_info->icon_uri) {
                                        app_data->parseError
-                                               = OP_ERR_FAIL_TO_MEMALLOC;
+                                                       = OP_ERR_FAIL_TO_MEMALLOC;
                                        goto ERR;
                                }
                                strncpy(dd_info->icon_uri, (const char*)ch_str,
-                                       strlen(ch_str));
+                                               strlen(ch_str));
                                OP_SLOG("dd_info->icon_uri:[%s]",
                                                dd_info->icon_uri);
                        }
@@ -588,21 +574,21 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
                        if (IS_ELEMENT_CONTINUING(app_data->element_index)) {
                                char *temp = NULL;
                                temp = op_com_utils_concat(dd_info->next_url,
-                                       ch_str);
+                                               ch_str);
                                if (temp) {
                                        free(dd_info->next_url);
                                        dd_info->next_url = temp;
                                }
                        } else {
                                dd_info->next_url = (char*)calloc(1, strlen(
-                                       ch_str) + 1);
+                                               ch_str) + 1);
                                if (OP_NULL == dd_info->next_url) {
                                        app_data->parseError
-                                               = OP_ERR_FAIL_TO_MEMALLOC;
+                                                       = OP_ERR_FAIL_TO_MEMALLOC;
                                        goto ERR;
                                }
                                strncpy(dd_info->next_url, (const char*)ch_str,
-                                       strlen(ch_str));
+                                               strlen(ch_str));
                        }
 
                        OP_SLOG("dd_info->next_url:[%s]",
@@ -612,7 +598,7 @@ void op_libxml_characters_dd1(void *userData, const xmlChar *s, int len)
 
                case DD1_ELEMENT_PROGRESS:
                        if (strcmp("true", (char*)ch_str) == 0 || strcmp(
-                               "TRUE", (char*)ch_str) == 0) {
+                                       "TRUE", (char*)ch_str) == 0) {
                                        dd_info->progressive_download_flag = OP_TRUE;
                        } else {
                                dd_info->progressive_download_flag = OP_FALSE;

diff --git a/packaging/org.tizen.download-manager.spec b/packaging/org.tizen.download-manager.spec
index 326545b..c1a4ba8 100755 (executable)
--- a/packaging/org.tizen.download-manager.spec
+++ b/packaging/org.tizen.download-manager.spec
@@ -1,7 +1,7 @@
 %define _ux_define tizen2.3
 Name:  org.tizen.download-manager
 Summary:       Application for support of the content download
-Version:       0.3.23
+Version:       0.3.24
 Release:       1
 License:       Flora-1.1
 Group:         misc