Fix crash if the input value of date popup is too long

[Title] Fix crash if the input value of date popup is too long.
[Issue#] N_SE-49571
[Problem] Crash on date popup.
[Cause] Input value is too long.
[Solution] Applied to check string length.

Change-Id: If18ba394c68c236590ce640ba37a3266ca359d64

diff --git a/Source/WebKit2/UIProcess/API/efl/tizen/InputPicker.cpp b/Source/WebKit2/UIProcess/API/efl/tizen/InputPicker.cpp
index 39e4d0d..557f803 100755 (executable)
--- a/Source/WebKit2/UIProcess/API/efl/tizen/InputPicker.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/tizen/InputPicker.cpp
@@ -34,10 +34,29 @@
 extern void* EflAssistHandle;
 #endif
 
-const unsigned maxDatetimeLength = 32;
-
 #if OS(TIZEN) && ENABLE(TIZEN_INPUT_TAG_EXTENSION)
 
+const unsigned maxDatetimeLength = 32;
+const unsigned maxDateStringLength = 10;
+
+struct Input_Date {
+    int year;
+    int mon;
+    int day;
+    int hour;
+    int min;
+    int sec;
+};
+
+struct Input_Date_Str {
+    char year[maxDateStringLength];
+    char mon[maxDateStringLength];
+    char day[maxDateStringLength];
+    char hour[maxDateStringLength];
+    char min[maxDateStringLength];
+    char sec[maxDateStringLength];
+};
+
 #if ENABLE(TIZEN_HW_MORE_BACK_KEY)
 static inline void _picker_back_cb(void* data, Evas_Object* obj, void* event_info)
 {
@@ -612,13 +631,13 @@ void InputPicker::ewk_date_popup(const char* inputValue)
         snprintf(tmpinputValue, maxDatetimeLength, "%s", inputValue);
         char* token = strtok(tmpinputValue,"-");
         if (token)
-            strcpy(dateStr.year, token);
+            strncpy(dateStr.year, token, maxDateStringLength);
         token = strtok(0, "-");
         if (token)
-            strcpy(dateStr.mon, token);
+            strncpy(dateStr.mon, token, maxDateStringLength);
         token = strtok(0, "-");
         if (token)
-            strcpy(dateStr.day, token);
+            strncpy(dateStr.day, token, maxDateStringLength);
 
         if (dateStr.year)
             currentTime->tm_year = atoi(dateStr.year);
@@ -808,7 +827,7 @@ void InputPicker::ewk_week_popup(const char* inputValue)
         snprintf(tmpinputValue, maxDatetimeLength, "%s", inputValue);
         char* token = strtok(tmpinputValue,"-");
         if (token)
-            strcpy(dateStr.year, token);
+            strncpy(dateStr.year, token, maxDateStringLength);
         const char* week = strstr(inputValue, "W");
         int weekNum = 1;
         if (week + 1)
@@ -924,10 +943,10 @@ void InputPicker::ewk_time_popup(const char* inputValue)
         snprintf(tmpinputValue, maxDatetimeLength, "%s", inputValue);
         char* token = strtok(tmpinputValue,":");
         if (token)
-            strcpy(dateStr.hour, token);
+            strncpy(dateStr.hour, token, maxDateStringLength);
         token = strtok(0, ":");
         if (token)
-            strcpy(dateStr.min, token);
+            strncpy(dateStr.min, token, maxDateStringLength);
 
         if (dateStr.hour)
             currentTime->tm_hour = atoi(dateStr.hour);
@@ -1015,10 +1034,10 @@ void InputPicker::ewk_month_popup(const char* inputValue)
         snprintf(tmpInputValue, maxDatetimeLength, "%s", inputValue);
         char* token = strtok(tmpInputValue,"-");
         if (token)
-            strcpy(dateStr.year, token);
+            strncpy(dateStr.year, token, maxDateStringLength);
         token = strtok(0, "-");
         if (token)
-            strcpy(dateStr.mon, token);
+            strncpy(dateStr.mon, token, maxDateStringLength);
 
         if (dateStr.year)
             currentTime->tm_year = atoi(dateStr.year);
@@ -1109,25 +1128,25 @@ void InputPicker::ewk_datetime_popup(const char* inputValue, bool local)
         snprintf(tmpInputValue, maxDatetimeLength, "%s", inputValue);
         char* token = strtok(tmpInputValue,"-");
         if (token)
-            strcpy(dateStr.year, token);
+            strncpy(dateStr.year, token, maxDateStringLength);
         token = strtok(0, "-");
         if (token)
-            strcpy(dateStr.mon, token);
+            strncpy(dateStr.mon, token, maxDateStringLength);
         token = strtok(0, "T");
         if (token)
-            strcpy(dateStr.day, token);
+            strncpy(dateStr.day, token, maxDateStringLength);
         token = strtok(0, ":");
         if (token)
-            strcpy(dateStr.hour, token);
+            strncpy(dateStr.hour, token, maxDateStringLength);
 
         if (local) {
             token = strtok(0, "Z");
             if (token)
-                strcpy(dateStr.min, token);
+                strncpy(dateStr.min, token, maxDateStringLength);
         } else {
             token = strtok(0, ":");
             if (token)
-                strcpy(dateStr.min, token);
+                strncpy(dateStr.min, token, maxDateStringLength);
         }
 
         if (dateStr.year)

diff --git a/Source/WebKit2/UIProcess/API/efl/tizen/InputPicker.h b/Source/WebKit2/UIProcess/API/efl/tizen/InputPicker.h
index de8204c..11707f5 100644 (file)
--- a/Source/WebKit2/UIProcess/API/efl/tizen/InputPicker.h
+++ b/Source/WebKit2/UIProcess/API/efl/tizen/InputPicker.h
@@ -29,22 +29,6 @@
 
 typedef struct _Evas_Object Evas_Object;
 
-struct Input_Date {
-    int year;
-    int mon;
-    int day;
-    int hour;
-    int min;
-    int sec;
-};
-struct Input_Date_Str {
-    char year[10];
-    char mon[10];
-    char day[10];
-    char hour[10];
-    char min[10];
-    char sec[10];
-};
 class Input_Picker_Layout {
 public:
     Input_Picker_Layout(Evas_Object*);