check limit size of data

Change-Id: Ib48c2c4e7f774054f96022af22450e92bd07962a
Signed-off-by: Jongkyu Koo <jk.koo@samsung.com>

diff --git a/src/pims-ipc-data.c b/src/pims-ipc-data.c
index fbd6655..a9eb354 100644 (file)
--- a/src/pims-ipc-data.c
+++ b/src/pims-ipc-data.c
@@ -23,6 +23,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <glib.h>
+#include <limits.h>
 
 #include "pims-internal.h"
 #include "pims-ipc-data.h"
@@ -47,6 +48,11 @@
 #define _get_used_size(data_size) \
        (sizeof(int) + data_size + ((sizeof(int) - (data_size % sizeof(int)))%sizeof(int)))
 
+/* sizeof(total_len) + sizeof(client_id_len) + client_id_len + sizeof(data->seq_no)
+       + data->call_id_len + sizeof(data->call_id) + sizeof(data->has_data) < 100 byte */
+#define RAW_DATA_HEADER_SIZE 100
+#define DATA_SIZE_LIMIT (UINT_MAX - RAW_DATA_HEADER_SIZE)
+
 API pims_ipc_data_h pims_ipc_data_create_with_size(unsigned int size, int flags)
 {
        pims_ipc_data_s *handle = NULL;
@@ -108,12 +114,21 @@ API int pims_ipc_data_put(pims_ipc_data_h data, void *buf, unsigned int size)
        }
 
        used_size = _get_used_size(dsize);
+
+       if (DATA_SIZE_LIMIT - handle->buf_size < used_size) {
+               ERR("Exceeded Limit");
+               return -1;
+       }
+
        if (handle->free_size < used_size) {
                int new_size = 0;
-               new_size = handle->alloc_size * 2;
+               new_size = (used_size < handle->alloc_size) ? handle->alloc_size : used_size;
+
+               if (DATA_SIZE_LIMIT - new_size < new_size)
+                       new_size = handle->buf_size + used_size;
+               else
+                       new_size *=  2;
 
-               while (new_size < handle->buf_size + used_size)
-                       new_size *= 2;
                handle->buf = realloc(handle->buf, new_size);
                if (NULL == handle->buf) {
                        ERR("realloc() Fail");
@@ -126,7 +141,7 @@ API int pims_ipc_data_put(pims_ipc_data_h data, void *buf, unsigned int size)
                VERBOSE("free_size [%d] dsize [%d]", handle->free_size, dsize);
        }
 
-       *(int*)(handle->pos) = dsize;
+       *(unsigned int*)(handle->pos) = dsize;
        if (dsize > 0) {
                memcpy((handle->pos+sizeof(int)), buf, dsize);
                int pad_size = used_size-dsize-sizeof(int);