Fix buffer overflow

To add size check of the received data before reading into the buffer

Change-Id: I10989d5c5c1a09323b9fc7c3ab521025968a780e
Signed-off-by: Vyacheslav Cherkashin <v.cherkashin@samsung.com>

diff --git a/daemon/da_protocol.c b/daemon/da_protocol.c
index f866368f8315196395967fc1eae34abe6fba7ecb..d68adb486ce19564882089768b3008a8ec511f74 100644 (file)
--- a/daemon/da_protocol.c
+++ b/daemon/da_protocol.c
@@ -1137,6 +1137,7 @@ int recv_msg_from_sock(int sock, struct msg_target_t *msg, size_t data_len)
 {
        ssize_t ret;
 
+       /* Read header to msg_target_t struct */
        ret = recv(sock, msg, MSG_HEADER_LEN, MSG_WAITALL);
        if (ret != MSG_HEADER_LEN)
                return 1;
@@ -1145,23 +1146,34 @@ int recv_msg_from_sock(int sock, struct msg_target_t *msg, size_t data_len)
                struct msg_data_t *msg_data = (struct msg_data_t *)msg;
                size_t n = MSG_DATA_HDR_LEN - MSG_HEADER_LEN;
 
+               if (n > data_len)
+                       return 1;
+
+               /*
+                * Finish reading header to msg_data struct.
+                * First part was read in the context of msg_target_t struct.
+                */
                ret = recv(sock, (char *)msg_data + MSG_HEADER_LEN,
                           n, MSG_WAITALL);
                if (ret != n)
                        return 1;
 
-               if (msg_data->len > TARGER_MSG_MAX_LEN - 12)
-                       return 1;
+               /* Read payload to msg_data_t struct */
+               if (msg_data->len > 0) {
+                       if (msg_data->len + n > data_len)
+                               return 1;
 
-               ret = recv(sock, msg_data->payload,
-                          msg_data->len, MSG_WAITALL);
+                       ret = recv(sock, msg_data->payload,
+                                  msg_data->len, MSG_WAITALL);
 
-               if (ret != msg_data->len)
-                       return 1;
+                       if (ret != msg_data->len)
+                               return 1;
+               }
 
                return 0;
        }
 
+       /* Read payload to msg_target_t struct */
        if (msg->length > 0) {
                if (msg->length >= data_len)
                        return 1;