Fixed security issues from SSMS

Change-Id: I7bb6e161b08b20c4861c0c434c046160e2e51a6d
Signed-off-by: Jihoon Jung <jh8801.jung@samsung.com>

diff --git a/src/mdg-manager/include/mdgd_db.h b/src/mdg-manager/include/mdgd_db.h
index 54aa89c..88f7e84 100644 (file)
--- a/src/mdg-manager/include/mdgd_db.h
+++ b/src/mdg-manager/include/mdgd_db.h
@@ -38,8 +38,8 @@ int mdgd_db_device_delete(char *group_name, char *device_id);
 bool mdgd_db_check_device_exist(char *device_id);
 bool mdgd_db_check_device_exist_in_group(char *group_name, char *device_id);
 bool mdgd_db_check_group_exist(const char *group_name);
-void mdgd_db_get_groups(char **groups, int *group_count);
-void mdgd_db_get_devices_in_group(char *group_name, mdgd_device_t **devices, int *device_count);
+void mdgd_db_get_groups(char ***groups, int *group_count);
+void mdgd_db_get_devices_in_group(char *group_name, mdgd_device_t ***devices, int *device_count);
 int mdgd_db_group_print();
 int mdgd_db_device_print();
 

diff --git a/src/mdg-manager/src/mdgd_db.c b/src/mdg-manager/src/mdgd_db.c
index d365778..fc183d6 100644 (file)
--- a/src/mdg-manager/src/mdgd_db.c
+++ b/src/mdg-manager/src/mdgd_db.c
@@ -579,7 +579,7 @@ bool mdgd_db_check_group_exist(const char *group_name)
        return result;
 }
 
-void mdgd_db_get_groups(char **groups, int *group_count)
+void mdgd_db_get_groups(char ***groups, int *group_count)
 {
        int ret, i = 0;
        char *sql = NULL;
@@ -594,8 +594,11 @@ void mdgd_db_get_groups(char **groups, int *group_count)
 
                ret = sqlite3_prepare_v2(mdgd_ctx->db, sql, strlen(sql), &stmt, NULL);
                if (ret == SQLITE_OK) {
+                       int column_count = sqlite3_column_count(stmt);
+                       *groups = g_new0(char*, column_count);
+
                        while (sqlite3_step(stmt) == SQLITE_ROW)
-                               groups[i++] = g_strdup((char *)sqlite3_column_text(stmt, 1));
+                               (*groups)[i++] = g_strdup((char *)sqlite3_column_text(stmt, 1));
 
                        sqlite3_finalize(stmt);
                } else {
@@ -612,7 +615,7 @@ void mdgd_db_get_groups(char **groups, int *group_count)
        LOG_END();
 }
 
-void mdgd_db_get_devices_in_group(char *group_name, mdgd_device_t **devices, int *device_count)
+void mdgd_db_get_devices_in_group(char *group_name, mdgd_device_t ***devices, int *device_count)
 {
        int ret, i = 0;
        char *sql = NULL;
@@ -629,16 +632,19 @@ void mdgd_db_get_devices_in_group(char *group_name, mdgd_device_t **devices, int
 
                ret = sqlite3_prepare_v2(mdgd_ctx->db, sql, strlen(sql), &stmt, NULL);
                if (ret == SQLITE_OK) {
+                       int column_count = sqlite3_column_count(stmt);
+                       *devices = g_new0(mdgd_device_t *, column_count);
+
                        while (sqlite3_step(stmt) == SQLITE_ROW) {
-                               devices[i] = g_new0(mdgd_device_t, 1);
-                               devices[i]->device_id = g_strdup((char *)sqlite3_column_text(stmt, 2));
-                               devices[i]->model_name = g_strdup((char *)sqlite3_column_text(stmt, 3));
-                               devices[i]->device_name = g_strdup((char *)sqlite3_column_text(stmt, 4));
-                               devices[i]->platform_ver = g_strdup((char *)sqlite3_column_text(stmt, 5));
-                               devices[i]->vendor_id = g_strdup((char *)sqlite3_column_text(stmt, 6));
-                               devices[i]->profile = g_strdup((char *)sqlite3_column_text(stmt, 7));
-                               devices[i]->is_invited = sqlite3_column_int(stmt, 8);
-                               devices[i]->type = sqlite3_column_int(stmt, 9);
+                               (*devices)[i] = g_new0(mdgd_device_t, 1);
+                               (*devices)[i]->device_id = g_strdup((char *)sqlite3_column_text(stmt, 2));
+                               (*devices)[i]->model_name = g_strdup((char *)sqlite3_column_text(stmt, 3));
+                               (*devices)[i]->device_name = g_strdup((char *)sqlite3_column_text(stmt, 4));
+                               (*devices)[i]->platform_ver = g_strdup((char *)sqlite3_column_text(stmt, 5));
+                               (*devices)[i]->vendor_id = g_strdup((char *)sqlite3_column_text(stmt, 6));
+                               (*devices)[i]->profile = g_strdup((char *)sqlite3_column_text(stmt, 7));
+                               (*devices)[i]->is_invited = sqlite3_column_int(stmt, 8);
+                               (*devices)[i]->type = sqlite3_column_int(stmt, 9);
 
                                i++;
                        }

diff --git a/src/mdg-manager/src/mdgd_gdbus.c b/src/mdg-manager/src/mdgd_gdbus.c
index 4f49f49..3b3fad1 100644 (file)
--- a/src/mdg-manager/src/mdgd_gdbus.c
+++ b/src/mdg-manager/src/mdgd_gdbus.c
@@ -214,6 +214,7 @@ gboolean group_send_data(Group *group, GDBusMethodInvocation *invocation,
 
        int length = 0;
        int len;
+       int iter_len;
        unsigned char *data;
        GVariantIter *iter;
        int msg_id;
@@ -221,16 +222,22 @@ gboolean group_send_data(Group *group, GDBusMethodInvocation *invocation,
        LOG_BEGIN();
 
        g_variant_get(params, "(iay)", &len, &iter);
+       iter_len = g_variant_iter_n_children(iter);
+
+       if (len > iter_len) {
+               LOG_ERR("len is too bigger than real data");
+               return TRUE;
+       }
 
        data = g_try_malloc0(len + 1);
        if (NULL == data) {
-               group_complete_send_data(group, invocation, -1, 0);
                LOG_ERR("Failed to allocate memory");
                return TRUE;
        }
 
-       while (g_variant_iter_loop(iter, "y", &data[length]))
-               length += 1;
+       for (int i = 0; i < len; i++) {
+               g_variant_iter_loop(iter, "y", &data[i]);
+       }
 
        g_variant_iter_free(iter);
 
@@ -253,12 +260,19 @@ gboolean group_send_response(Group *group, GDBusMethodInvocation *invocation,
 
        int length = 0;
        int len;
+       int iter_len;
        unsigned char *data;
        GVariantIter *iter;
 
        LOG_BEGIN();
 
        g_variant_get(params, "(iay)", &len, &iter);
+       iter_len = g_variant_iter_n_children(iter);
+
+       if (len > iter_len) {
+               LOG_ERR("len is too bigger than real data");
+               return TRUE;
+       }
 
        data = g_try_malloc0(len + 1);
        if (NULL == data) {
@@ -267,8 +281,9 @@ gboolean group_send_response(Group *group, GDBusMethodInvocation *invocation,
                return TRUE;
        }
 
-       while (g_variant_iter_loop(iter, "y", &data[length]))
-               length += 1;
+       for (int i = 0; i < len; i++) {
+               g_variant_iter_loop(iter, "y", &data[i]);
+       }
 
        g_variant_iter_free(iter);
 

diff --git a/src/mdg-manager/src/mdgd_group.c b/src/mdg-manager/src/mdgd_group.c
index a66ecc0..b9538e1 100644 (file)
--- a/src/mdg-manager/src/mdgd_group.c
+++ b/src/mdg-manager/src/mdgd_group.c
@@ -43,7 +43,7 @@ int mdgd_group_create(const char *name)
 int mdgd_group_delete(char *name)
 {
        int ret = MDGD_ERROR_NONE;
-       mdgd_device_t *devices[256];
+       mdgd_device_t **devices;
        int device_count = 0;
 
        LOG_BEGIN();
@@ -51,7 +51,7 @@ int mdgd_group_delete(char *name)
        mdgd_context_t *mdgd_ctx = mdgd_context_get_context();
 
        /* Get all device in group */
-       mdgd_db_get_devices_in_group(name, devices, &device_count);
+       mdgd_db_get_devices_in_group(name, &devices, &device_count);
        for (int i = 0; i < device_count; i++) {
                mdgd_db_device_delete(name, devices[i]->device_id);
 

diff --git a/src/mdg-manager/src/mdgd_iot_server.cpp b/src/mdg-manager/src/mdgd_iot_server.cpp
index 05ccedd..a7530ed 100644 (file)
--- a/src/mdg-manager/src/mdgd_iot_server.cpp
+++ b/src/mdg-manager/src/mdgd_iot_server.cpp
@@ -352,9 +352,9 @@ OCEntityHandlerResult _request_handler(std::shared_ptr<OCResourceRequest> reques
                        } else if (strcmp(resourceUri.c_str(),
                                          mdgd_resource_get_uri_prefix(MDGD_RESOURCE_TYPE_GROUP)) == 0) {
                                int group_count;
-                               char *groups[256];
+                               char **groups;
 
-                               mdgd_db_get_groups(groups, &group_count);
+                               mdgd_db_get_groups(&groups, &group_count);
                                std::vector<std::string> group_list;
                                for (int i = 0; i < group_count; i++) {
                                        LOG_DEBUG("%d. group name : %s", i + 1, groups[i]);

diff --git a/src/mdg-manager/src/mdgd_util.c b/src/mdg-manager/src/mdgd_util.c
index 6c3d782..06c0104 100644 (file)
--- a/src/mdg-manager/src/mdgd_util.c
+++ b/src/mdg-manager/src/mdgd_util.c
@@ -456,13 +456,13 @@ GVariant *mdgd_create_variant_device_list(char *group_name)
 
        builder = g_variant_builder_new(G_VARIANT_TYPE("aa{sv}"));
 
-       mdgd_device_t *devices[256];
+       mdgd_device_t **devices;
        int device_count = 0;
 
        LOG_BEGIN();
 
        /* Get all device in group */
-       mdgd_db_get_devices_in_group(group_name, devices, &device_count);
+       mdgd_db_get_devices_in_group(group_name, &devices, &device_count);
 
        for (int i = 0; i < device_count; i++) {
                mdgd_device_t *device = devices[i];