Added to check validation of pointer 00/68900/5 accepted/tizen/common/20160511.142321 accepted/tizen/ivi/20160512.050950 accepted/tizen/mobile/20160512.051025 accepted/tizen/tv/20160512.050937 accepted/tizen/wearable/20160512.050954 submit/tizen/20160511.083354
authoryoonki.park <yoonki.park@samsung.com>
Tue, 10 May 2016 08:37:32 +0000 (17:37 +0900)
committershingil.kang <shingil.kang@samsung.com>
Wed, 11 May 2016 08:03:42 +0000 (17:03 +0900)
- If packet pointer has invalid address then restart SDBD.

Change-Id: Ieff9343bba35dcfe5122c18ddea60eec615bac76
Signed-off-by: shingil.kang <shingil.kang@samsung.com>
packaging/sdbd.spec
packaging/sdbd_device.service
src/fdevent.c
src/sdb.c
src/transport.c

index a05aff7..826c4f0 100644 (file)
@@ -2,7 +2,7 @@
 
 Name:       sdbd
 Summary:    SDB daemon
-Version:    3.0.10
+Version:    3.0.11
 Release:    0
 License:    Apache-2.0
 Summary:    SDB daemon
index e83b1f7..4fe803f 100644 (file)
@@ -7,7 +7,7 @@ After=tmp.mount
 Type=forking
 EnvironmentFile=-/run/tizen-system-env
 PIDFile=/tmp/.sdbd.pid
-RemainAfterExit=yes
+Restart=on-failure
 ExecStart=/usr/sbin/sdbd
 
 [Install]
index ca1bf3c..2e8a45a 100644 (file)
@@ -50,7 +50,7 @@ static void fatal(const char *fn, const char *fmt, ...)
     fprintf(stderr, "%s:", fn);
     vfprintf(stderr, fmt, ap);
     va_end(ap);
-    abort();
+    exit(-1);
 }
 
 #define FATAL(x...) fatal(__FUNCTION__, x)
index 793d8ec..1fbd885 100644 (file)
--- a/src/sdb.c
+++ b/src/sdb.c
@@ -630,6 +630,13 @@ void parse_banner(char *banner, atransport *t)
 
 void handle_packet(apacket *p, atransport *t)
 {
+    // Verify pointer p
+    int result = access((const char *) p, F_OK);
+    if ((result == -1) && (errno == EFAULT)) {
+        D("Invalid apacket = [0x%x]", p);
+        fatal("Invalid apacket = [0x%x]", p);
+    }
+
     asocket *s;
 
     D("handle_packet() %c%c%c%c\n", ((char*) (&(p->msg.command)))[0],
index a697eee..1fe4b9d 100644 (file)
@@ -323,6 +323,14 @@ static void *input_thread(void *_t)
                t->serial, t->fd );
             break;
         }
+
+        // Verify pointer p
+        int result = access((const char *) p, F_OK);
+        if ((result == -1) && (errno == EFAULT)) {
+            D("Invalid apacket = [0x%x]", p);
+            fatal("Invalid apacket = [0x%x]", p);
+        }
+
         if(p->msg.command == A_SYNC){
             if(p->msg.arg0 == 0) {
                 D("%s: transport SYNC offline\n", t->serial);