From: samanway <samanway@linux-samanway.sa.corp.samsungelectronics.net>
Date: Tue, 4 Feb 2020 11:07:38 +0000 (+0530)
Subject: [CONPRO-1561] Crash in memcpy
X-Git-Tag: submit/tizen_5.5/20200219.001653
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=729a637f1249fae3b2e506e51a0aee0ca09ba1fb;p=platform%2Fupstream%2Fiotivity.git

[CONPRO-1561] Crash in memcpy

- In Caremotehandler.c, function CACloneInfo was copying token into buffer in vulnurable way
- Fixed it appending NULL in destination string

https://github.sec.samsung.net/RS7-IOTIVITY/IoTivity/pull/662
(cherry-picked from f8af2d6ca117bdf270c97c5c28f86bb0169659e5)

Change-Id: I84dfff77ecbf3a333913ce341060d7e30444ac62
Signed-off-by: samanway <samanway-dey@samsung.com>
Signed-off-by: DoHyun Pyun <dh79.pyun@samsung.com>
---

diff --git a/resource/csdk/connectivity/common/src/caremotehandler.c b/resource/csdk/connectivity/common/src/caremotehandler.c
index 1e5b7e9..638c04f 100644
--- a/resource/csdk/connectivity/common/src/caremotehandler.c
+++ b/resource/csdk/connectivity/common/src/caremotehandler.c
@@ -261,7 +261,7 @@ CAResult_t CACloneInfo(const CAInfo_t *info, CAInfo_t *clone)
         // allocate token field
         uint8_t len = info->tokenLength;
 
-        char *temp = (char *) OICMalloc(len * sizeof(char));
+        char *temp = (char *) OICCalloc(1, (len + 1) * sizeof(char));
         if (!temp)
         {
             OIC_LOG(ERROR, TAG, "CACloneInfo Out of memory");