temp_buf = (char *)calloc(1, full_msg_size + 1);
if (temp_buf == NULL) {
mc_error("Error memroy allocation");
+ close(sockfd);
return MEDIA_CONTROLLER_ERROR_OUT_OF_MEMORY;
}
+
memcpy(temp_buf, &send_msg, head_msg_size);
memcpy(temp_buf + head_msg_size, request_msg, request_msg_size);
}
}
- if (recv_msg->msg_size > 0) {
+ if ((recv_msg->msg_size > 0) && (recv_msg->msg_size <= SIZE_MAX - 1)) {
size_t remain_size = recv_msg->msg_size;
size_t block_size = 0;
size_t msg_index = 0;
}
}
+ if (recv_msg_size > remain_size) {
+ mc_error("recv_msg_size [%zu] remain_size [%zu]", recv_msg_size, remain_size);
+ break;
+ }
+
memcpy(recv_msg->msg + msg_index, recv_buf, recv_msg_size);
msg_index += recv_msg_size;
+
remain_size -= recv_msg_size;
}
MC_SAFE_FREE(recv_buf);
} else {
- mc_error("msg_size is zero");
+ mc_error("wrong msg_size [%zu]", recv_msg->msg_size);
recv_msg->msg = NULL;
}