Fix security issue

 - strncpy doesn't set zero byte

[Version] 0.1.64
[Profile] Common
[Issue Type] Security issue
[Issue#] SATIZENVUL-957
Signed-off-by: SeokHoon Lee <andy.shlee@samsung.com>
Change-Id: I3e44b02d6237542f150babacb7474d5be2e5f9ca

diff --git a/miracast_server/miracast_server_impl.c b/miracast_server/miracast_server_impl.c
index aa0ccbd36958c56f99f43f96b7e1b808071c7a72..6e69aa4e2557ad0845b8bb6106c8b2cd4c999ce0 100644 (file)
--- a/miracast_server/miracast_server_impl.c
+++ b/miracast_server/miracast_server_impl.c
@@ -166,10 +166,11 @@ int __miracast_server_send_resp(MiracastServer *server, const gchar *cmd)
 {
        int ret = SCMIRRORING_ERROR_NONE;
        char *_cmd = NULL;
+       int _cmdLen = 0;
        int client_sock = -1;
 
-       if (server == NULL) {
-               scmirroring_error("OUT_OF_MEMORY");
+       if (server == NULL || cmd == NULL) {
+               scmirroring_error("Invaild server or cmd!");
                return SCMIRRORING_ERROR_INVALID_OPERATION;
        }
 
@@ -180,9 +181,13 @@ int __miracast_server_send_resp(MiracastServer *server, const gchar *cmd)
        }
 
        _cmd = g_strdup(cmd);
-       _cmd[strlen(_cmd)] = '\0';
+       if (_cmd == NULL) {
+               scmirroring_error("Faild in g_strdup for cmd!");
+               return SCMIRRORING_ERROR_OUT_OF_MEMORY;
+       }
 
-       if (write(client_sock, _cmd, strlen(_cmd) + 1) != ((int)(strlen(_cmd) + 1))) {
+       _cmdLen = strlen(_cmd) + 1;
+       if (write(client_sock, _cmd, _cmdLen) != _cmdLen) {
                char buf[255] = {0, };
                strerror_r(errno, buf, sizeof(buf));
                scmirroring_error("sendto failed [%s]", buf);

diff --git a/packaging/capi-media-screen-mirroring.spec b/packaging/capi-media-screen-mirroring.spec
index cb831be6846d21dc49c695d5a67b6b46c7f4ae21..dab1c271b3f36709b135a985cffba8373f30d9e6 100644 (file)
--- a/packaging/capi-media-screen-mirroring.spec
+++ b/packaging/capi-media-screen-mirroring.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-screen-mirroring
 Summary:    A screen mirroring library in Tizen C API
-Version:    0.1.63
+Version:    0.1.64
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0

diff --git a/src/scmirroring_src.c b/src/scmirroring_src.c
index 3f5ed4d1d54d44ac7635cd0a587fc6c59a2a7050..00f65fe609e821bb3cd34240b45edf9f32f3ad86 100644 (file)
--- a/src/scmirroring_src.c
+++ b/src/scmirroring_src.c
@@ -64,14 +64,19 @@ static int __scmirroring_src_send_cmd_to_server(scmirroring_src_s *scmirroring,
 {
        int ret = SCMIRRORING_ERROR_NONE;
        char *_cmd = NULL;
+       int _cmdLen = 0;
 
        scmirroring_retvm_if(scmirroring == NULL, SCMIRRORING_ERROR_INVALID_PARAMETER, "scmirroring is NULL");
        scmirroring_retvm_if(cmd == NULL, SCMIRRORING_ERROR_INVALID_PARAMETER, "cmd is NULL");
 
        _cmd = g_strdup(cmd);
-       _cmd[strlen(_cmd)] = '\0';
+       if (_cmd == NULL) {
+               scmirroring_error("Out of memory for command buffer");
+               return SCMIRRORING_ERROR_OUT_OF_MEMORY;
+       }
 
-       if (write(scmirroring->sock, _cmd, strlen(_cmd) + 1) != (signed int) strlen(_cmd) + 1) {
+       _cmdLen = strlen(_cmd) + 1;
+       if (write(scmirroring->sock, _cmd, _cmdLen) != _cmdLen) {
                char buf[255] = {0, };
                strerror_r(errno, buf, sizeof(buf));
                scmirroring_error("sendto failed [%s]", buf);