Added safe_atoi to avoid unwanted loop because of tainted int 'num' 14/237314/4
authorjiyong.min <jiyong.min@samsung.com>
Mon, 29 Jun 2020 05:35:04 +0000 (14:35 +0900)
committerjiyong.min <jiyong.min@samsung.com>
Mon, 29 Jun 2020 23:35:22 +0000 (08:35 +0900)
Change-Id: I2fc79d9b9134cbee1cfdc7887f0effc3570b158a

test/metadata_editor_test.c

index 6321a4e37e97f8106c52ded0f2e09e819d47a5cd..14494972b6694bc268270e0a4bab5db7f2b43519 100755 (executable)
@@ -161,8 +161,10 @@ static bool __get_tag_info(metadata_editor_h metadata)
                else if ((ret == METADATA_EDITOR_ERROR_NONE) && picture_index) {
                        int num = 0, i;
                        ret = __safe_atoi(picture_index, &num);
-                       if (ret != METADATA_EDITOR_ERROR_NONE || num < 0)
-                               return true;
+                       if (ret != METADATA_EDITOR_ERROR_NONE || num < 0) {
+                               printf("fail to __safe_atoi[%d]\n", ret);
+                               return false;
+                       }
 
                        printf("Number of pictures: %u\n", num);
 
@@ -379,8 +381,12 @@ static bool __delete_pictures(metadata_editor_h metadata)
 
        printf("The number of pictures is [%s]\n", picture_num);
 
-       num = atoi(picture_num);
+       ret = __safe_atoi(picture_num, &num);
        free(picture_num);
+       if (ret != METADATA_EDITOR_ERROR_NONE || num < 0) {
+               printf("fail to __safe_atoi[%d]\n", ret);
+               return false;
+       }
 
        if (num == 0) {
                printf("There are no pictures to delete\n");