Heap buffer overflow

Change-Id: Icbe3f7eb6340404e9a0ef899c91736e2aa237e11

diff --git a/server/fido_server.c b/server/fido_server.c
index d600cea..d1b3347 100755 (executable)
--- a/server/fido_server.c
+++ b/server/fido_server.c
@@ -156,27 +156,32 @@ _asm_get_info_cb(GList *asm_resp_list, void *user_data)
 
                if (asm_resp_list != NULL) {
 
-                       int str_list_len = g_list_length(asm_resp_list);
-                       char **asm_resp_json_arr = calloc(str_list_len, sizeof(int));
                        int data_len = 0;
                        int i = 0;
-
+                       int str_list_len = g_list_length(asm_resp_list);
                        GList *asm_resp_list_iter = g_list_first(asm_resp_list);
-                       while (asm_resp_list_iter != NULL) {
-                               _asm_discover_response_t *disc_resp = (_asm_discover_response_t*)(asm_resp_list_iter->data);
+                       char **asm_resp_json_arr = calloc(str_list_len, sizeof(int));
+
+                       if (asm_resp_json_arr != NULL) {
+                               while (asm_resp_list_iter != NULL) {
+                                       _asm_discover_response_t *disc_resp = (_asm_discover_response_t*)(asm_resp_list_iter->data);
 
-                               if (disc_resp->asm_response_json != NULL) {
-                                       asm_resp_json_arr[i++] = strdup(disc_resp->asm_response_json);
-                                       data_len++;
+                                       if (disc_resp->asm_response_json != NULL) {
+                                               asm_resp_json_arr[i] = strdup(disc_resp->asm_response_json);
+                                               if (asm_resp_json_arr[i] == NULL) {
+                                                       break;
+                                               }
+                                               i++;
+                                               data_len++;
+                                       }
+                                       asm_resp_list_iter = g_list_next(asm_resp_list_iter);
                                }
-                               asm_resp_list_iter = g_list_next(asm_resp_list_iter);
-                       }
 
-                  __send_discover_response(dbus_info->dbus_obj, dbus_info->invocation, FIDO_ERROR_NONE,
-                                                                                  asm_resp_json_arr, data_len);
+                               __send_discover_response(dbus_info->dbus_obj, dbus_info->invocation, FIDO_ERROR_NONE, asm_resp_json_arr, data_len);
+
+                       }
                } else
-                  __send_discover_response(dbus_info->dbus_obj, dbus_info->invocation, FIDO_ERROR_NOT_SUPPORTED,
-                                                                                  NULL, 0);
+               __send_discover_response(dbus_info->dbus_obj, dbus_info->invocation, FIDO_ERROR_NOT_SUPPORTED, NULL, 0);
        }
 
        if (asm_resp_list != NULL)