From: Sooyoung Ha <yoosah.ha@samsung.com>
Date: Thu, 17 Jan 2013 12:26:14 +0000 (+0900)
Subject: [Title] fix the untrusted value as argument. (various)
X-Git-Tag: submit/tizen/20150529.014734~8^2~14
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=13a70bb205abbe70c125d69aa285e3f8f9467ffd;p=platform%2Fadaptation%2Femulator%2Fvmodem-daemon-emulator.git

[Title] fix the untrusted value as argument. (various)
[Desc.] add new function for read 4 bytes packet on vmodem/server/misc.c
---

diff --git a/packaging/vmodemd-emul.spec b/packaging/vmodemd-emul.spec
index c9880fe..9cf6f8e 100644
--- a/packaging/vmodemd-emul.spec
+++ b/packaging/vmodemd-emul.spec
@@ -1,6 +1,6 @@
 #git:slp/pkgs/v/vmodem-daemon-emulator
 Name: vmodemd-emul
-Version: 0.2.35
+Version: 0.2.36
 Release: 1
 Summary: Modem Emulator
 Group: System/ModemEmulator
diff --git a/vmodem/include/server/misc.h b/vmodem/include/server/misc.h
index f9d62a5..ad32c10 100644
--- a/vmodem/include/server/misc.h
+++ b/vmodem/include/server/misc.h
@@ -43,6 +43,7 @@ char const* printCurrentState(LXT_PHONE_STATE CurrentState);
 int packed_S32(unsigned char* bytearray);
 unsigned short packed_U16(unsigned char* bytearray);
 void PacketDataFree(void *p);
+int ReadPacketBytes4(int fd, void *data);
 int ReadBytes(int fd, void *data, int size);
 void* PacketDataMalloc(int size);
 int WriteBytes(int fd, void *data, int size);
diff --git a/vmodem/server/client.c b/vmodem/server/client.c
index f7eb2cb..1701b3a 100644
--- a/vmodem/server/client.c
+++ b/vmodem/server/client.c
@@ -1450,7 +1450,7 @@ static int client_callback(PhoneServer * ps, int fd, EloopCondition cond, void *
 
 	TAPIMessageInit(&packet);
 
-	rc = ReadBytes(clientfd, &packet, 4);
+	rc = ReadPacketBytes4(clientfd, &packet);
 
 	if  (rc <= 0)
 	{
diff --git a/vmodem/server/misc.c b/vmodem/server/misc.c
index 86309a7..6924036 100644
--- a/vmodem/server/misc.c
+++ b/vmodem/server/misc.c
@@ -64,6 +64,33 @@ void PacketDataFree(void *p)
     }
 }
 
+int ReadPacketBytes4(int fd, void *data)
+{
+    int rc;
+    int size = 4;
+    LXT_MESSAGE tmp_buf;
+
+    if ( (data == 0) || (fd < 0) )
+    {
+        return -1;
+    }
+
+    rc = read(fd, &tmp_buf, size);
+
+    ((LXT_MESSAGE*)data)->length = (unsigned short)tmp_buf.length;
+    ((LXT_MESSAGE*)data)->group = (unsigned char)tmp_buf.group;
+    ((LXT_MESSAGE*)data)->action = (unsigned char)tmp_buf.action;
+
+
+    if (rc <= 0)
+    {
+        return -1;
+    }
+
+    return rc;
+
+}
+
 int ReadBytes(int fd, void *data, int size)
 {
     int rc;