From 1e48124e2c21e077017a0e008d02878faa9b7f7e Mon Sep 17 00:00:00 2001 From: Sameer Prakash Pradhan Date: Mon, 28 May 2018 17:24:44 +0530 Subject: [PATCH] [Non-ACR][email-service][sql injection fix] Change-Id: I8ea05e4e0eaccf48a3120dadc8439fdef0cbc19d Signed-off-by: Sameer Prakash Pradhan --- email-core/email-storage/email-storage.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/email-core/email-storage/email-storage.c b/email-core/email-storage/email-storage.c index bb86c67..336d830 100755 --- a/email-core/email-storage/email-storage.c +++ b/email-core/email-storage/email-storage.c @@ -1481,24 +1481,25 @@ static int emstorage_exec_query_by_prepare_v2_stmt(sqlite3 *local_db_handle, cha EMSTORAGE_PROTECTED_FUNC_CALL(sqlite3_prepare_v2(local_db_handle, query_string, EM_SAFE_STRLEN(query_string), &db_statement, NULL), rc); - _bind_stmt_field_data_string(db_statement, count++, target_mailbox_name, 0, EM_SAFE_STRLEN(target_mailbox_name)-1); + EM_DEBUG_DB_EXEC((SQLITE_OK != rc), {error = EMAIL_ERROR_DB_FAILURE; goto FINISH_OFF; }, + ("sqlite3_prepare_stmt failed [%d] [%s]", rc, query_string)); + + _bind_stmt_field_data_string(db_statement, count++, target_mailbox_name, 0, MAILBOX_NAME_LEN_IN_MAIL_BOX_TBL); _bind_stmt_field_data_int(db_statement, count++, input_mailbox_id); _bind_stmt_field_data_int(db_statement, count++, target_account_id); - EM_DEBUG_DB_EXEC((SQLITE_OK != rc), {error = EMAIL_ERROR_DB_FAILURE; goto FINISH_OFF; }, - ("sqlite3_prepare failed [%d] [%s]", rc, query_string)); EMSTORAGE_PROTECTED_FUNC_CALL(sqlite3_step(db_statement), rc); EM_DEBUG_DB_EXEC((rc != SQLITE_ROW && rc != SQLITE_DONE), {error = EMAIL_ERROR_DB_FAILURE; goto FINISH_OFF; }, - ("sqlite3_step failed [%d] [%s]", rc, query_string)); + ("sqlite3_step_stmt failed [%d] [%s]", rc, query_string)); FINISH_OFF: if (db_statement != NULL) { rc = sqlite3_finalize(db_statement); if (rc != SQLITE_OK) { - EM_DEBUG_EXCEPTION("sqlite3_finalize error [%d]", rc); + EM_DEBUG_EXCEPTION("sqlite3_finalize_stmt error [%d]", rc); error = EMAIL_ERROR_DB_FAILURE; } } @@ -9991,7 +9992,7 @@ INTERNAL_FUNC int emstorage_move_multiple_mails_on_db(char *multi_user_name, int EM_DEBUG_LOG_SEC("Query [%s]", sql_query_string); error = emstorage_exec_query_by_prepare_v2_stmt(local_db_handle, sql_query_string, target_mailbox_name, input_mailbox_id, target_account_id); if (error != EMAIL_ERROR_NONE) { - EM_DEBUG_EXCEPTION("emstorage_exec_query_by_prepare_v2 failed:[%d]", error); + EM_DEBUG_EXCEPTION("emstorage_exec_query_by_prepare_v2_stmt failed:[%d]", error); goto FINISH_OFF; } -- 2.7.4