Fix keyval decode function

- Adds the exceptions
- Adds a parameter about byte size

Change-Id: I44431f68929ab9115a5e24f641614b0a159f6082
Signed-off-by: Hwankyu Jhun <h.jhun@samsung.com>

diff --git a/src/bundle.c b/src/bundle.c
index 7879a5e..c766ee9 100644 (file)
--- a/src/bundle.c
+++ b/src/bundle.c
@@ -574,11 +574,14 @@ bundle *bundle_decode(const bundle_raw *r, const int data_size)
 
                /* Find type, and use decode function according to type */
                type = keyval_get_type_from_encoded_byte(p_r);
-               if (keyval_type_is_array(type))
+               if (keyval_type_is_array(type)) {
                        bytes_read = keyval_array_decode(p_r,
-                                       (keyval_array_t **) &kv);
-               else
-                       bytes_read = keyval_decode(p_r, &kv);
+                                       (keyval_array_t **)&kv,
+                                       d_r + d_len - 1 - p_r);
+               } else {
+                       bytes_read = keyval_decode(p_r, &kv,
+                                       d_r + d_len - 1 - p_r);
+               }
 
                if (kv)
                        _bundle_append_kv(b, kv);
@@ -716,11 +719,14 @@ bundle *bundle_decode_raw(const bundle_raw *r, const int data_size)
 
                /* Find type, and use decode function according to type */
                type = keyval_get_type_from_encoded_byte(p_r);
-               if (keyval_type_is_array(type))
+               if (keyval_type_is_array(type)) {
                        bytes_read = keyval_array_decode(p_r,
-                                       (keyval_array_t **) &kv);
-               else
-                       bytes_read = keyval_decode(p_r, &kv);
+                                       (keyval_array_t **)&kv,
+                                       d_r + d_len - 1 - p_r);
+               } else {
+                       bytes_read = keyval_decode(p_r, &kv,
+                                       d_r + d_len - 1 - p_r);
+               }
 
                if (kv)
                        _bundle_append_kv(b, kv);
@@ -866,11 +872,11 @@ bundle *bundle_import_from_argv(int argc, char **argv)
 
                type = keyval_get_type_from_encoded_byte(byte);
                if (keyval_type_is_array(type)) {
-                       if (keyval_array_decode(byte, &kva) == 0) /* TODO: error! */
+                       if (keyval_array_decode(byte, &kva, byte_size) == 0) /* TODO: error! */
                                BUNDLE_EXCEPTION_PRINT("Unable to Decode array\n");
                        kv = (keyval_t *)kva;
                } else {
-                       if (keyval_decode(byte, &kv) == 0) /* TODO: error! */
+                       if (keyval_decode(byte, &kv, byte_size) == 0) /* TODO: error! */
                                BUNDLE_EXCEPTION_PRINT("Unable to Decode\n");
                }
                _bundle_append_kv(b, kv);

diff --git a/src/keyval.c b/src/keyval.c
index 5a48c0e..ee069c2 100755 (executable)
--- a/src/keyval.c
+++ b/src/keyval.c
@@ -210,7 +210,7 @@ size_t keyval_encode(keyval_t *kv, unsigned char **byte, size_t *byte_len)
  *                  If kv is not NULL, given kv is used. (No new kv is created.)
  * @return        Number of bytes read from byte.
  */
-size_t keyval_decode(unsigned char *byte, keyval_t **kv)
+size_t keyval_decode(unsigned char *byte, keyval_t **kv, size_t byte_size)
 {
        static const size_t sz_byte_len = sizeof(size_t);
        static const size_t sz_type = sizeof(int);
@@ -225,14 +225,39 @@ size_t keyval_decode(unsigned char *byte, keyval_t **kv)
        unsigned char *p = byte;
 
        byte_len = *((size_t *)p);
+
+       if (byte_size < sz_byte_len)
+               return 0;
+
+       byte_size -= sz_byte_len;
        p += sz_byte_len;
        type = *((int *)p);
+
+       if (byte_size < sz_type)
+               return 0;
+
+       byte_size -= sz_type;
        p += sz_type;
        keysize = *((size_t *)p);
+
+       if (byte_size < sz_keysize)
+               return 0;
+
+       byte_size -= sz_keysize;
        p += sz_keysize;
        key = (char *)p;
+
+       if (byte_size < keysize)
+               return 0;
+
+       byte_size -= keysize;
        p += keysize;
        size = *((size_t *)p);
+
+       if (byte_size < sz_size)
+               return 0;
+
+       byte_size -= sz_size;
        p += sz_size;
        val = (void *)p;
        p += size;

diff --git a/src/keyval.h b/src/keyval.h
index 459c4ac..4cf3b6b 100755 (executable)
--- a/src/keyval.h
+++ b/src/keyval.h
@@ -63,7 +63,7 @@ void keyval_free(keyval_t *kv, int do_free_object);
 int keyval_compare(keyval_t *kv1, keyval_t *kv2);
 size_t keyval_get_encoded_size(keyval_t *kv);
 size_t keyval_encode(keyval_t *kv, unsigned char **byte, size_t *byte_len);
-size_t keyval_decode(unsigned char *byte, keyval_t **kv);
+size_t keyval_decode(unsigned char *byte, keyval_t **kv, size_t byte_size);
 int keyval_get_data(keyval_t *kv, int *type, void **val, size_t *size);
 int keyval_get_type_from_encoded_byte(unsigned char *byte);
 

diff --git a/src/keyval_array.c b/src/keyval_array.c
index b9d9886..db9d9c0 100755 (executable)
--- a/src/keyval_array.c
+++ b/src/keyval_array.c
@@ -319,7 +319,7 @@ size_t keyval_array_encode(keyval_array_t *kva, void **byte, size_t *byte_len)
        return *byte_len;
 }
 
-size_t keyval_array_decode(void *byte, keyval_array_t **kva)
+size_t keyval_array_decode(void *byte, keyval_array_t **kva, size_t byte_size)
 {
        static const size_t sz_byte_len = sizeof(size_t);
        static const size_t sz_type = sizeof(int);
@@ -338,16 +338,45 @@ size_t keyval_array_decode(void *byte, keyval_array_t **kva)
 
        /* Get data */
        byte_len = *((size_t *)p);
+
+       if (byte_size < sz_byte_len)
+               return 0;
+
+       byte_size -= sz_byte_len;
        p += sz_byte_len;
        type = *((int *)p);
+
+       if (byte_size < sz_type)
+               return 0;
+
+       byte_size -= sz_type;
        p += sz_type;
        keysize = *((size_t *)p);
+
+       if (byte_size < sz_keysize)
+               return 0;
+
+       byte_size -= sz_keysize;
        p += sz_keysize;
        key = (char *)p;
+
+       if (byte_size < keysize)
+               return 0;
+
+       byte_size -= keysize;
        p += keysize;
        len = *((unsigned int *)p);
+
+       if (byte_size < sz_len)
+               return 0;
+
+       byte_size -= sz_len;
        p += sz_len;
        array_element_size = (size_t *)p;
+
+       if (byte_size < (sizeof(size_t) * len))
+               return 0;
+
        p += sizeof(size_t) * len;
        array_val = (void *)p;
 

diff --git a/src/keyval_array.h b/src/keyval_array.h
index 47b38a9..510a1c8 100755 (executable)
--- a/src/keyval_array.h
+++ b/src/keyval_array.h
@@ -38,7 +38,7 @@ void keyval_array_free(keyval_array_t *kva, int do_free_object);
 int keyval_array_compare(keyval_array_t *kva1, keyval_array_t *kva2);
 size_t keyval_array_get_encoded_size(keyval_array_t *kva);
 size_t keyval_array_encode(keyval_array_t *kva, void **byte, size_t *byte_len);
-size_t keyval_array_decode(void *byte, keyval_array_t **kva);
+size_t keyval_array_decode(void *byte, keyval_array_t **kva, size_t byte_size);
 int keyval_array_copy_array(keyval_array_t *kva, void **array_val,
                unsigned int array_len, size_t (*measure_val_len)(void * val));
 int keyval_array_get_data(keyval_array_t *kva, int *type, void ***array_val,