Fix SVACE defect(WGID=423935, Buffer overflow)

Change-Id: Ia375b7898ca340f09383e713f11fc3d2864800f8
Signed-off-by: Dongsun Lee <ds73.lee@samsung.com>

diff --git a/tadcore/Svc/DrmTdcSvc.cpp b/tadcore/Svc/DrmTdcSvc.cpp
index 58ed521..e755548 100644 (file)
--- a/tadcore/Svc/DrmTdcSvc.cpp
+++ b/tadcore/Svc/DrmTdcSvc.cpp
@@ -625,7 +625,7 @@ int DrmTdcDecryptLicense(const char *pRespBuf, unsigned int respBufLen,
 
        //Get Decrypted License
        if ((ret = TADC_GetResponseRO((unsigned char *)pRespBuf, pt_ROAcqInfo, &t_RO,
-                                                                 (unsigned char *)pDecLicenseBuf)) < 0) {
+                                         (unsigned char *)pDecLicenseBuf, *decLicenseBufLen)) < 0) {
                DrmTdcDHInfoFree(idx); //2010.02.26
                DRM_TAPPS_EXCEPTION("TADC_GetResponseRO! Ret[%x]", ret);
                return TADC_GET_RORES_INFO_ERROR;

diff --git a/tadcore/TADCCore/TADC_Core.cpp b/tadcore/TADCCore/TADC_Core.cpp
index ffee8cf..d1d4fef 100644 (file)
--- a/tadcore/TADCCore/TADC_Core.cpp
+++ b/tadcore/TADCCore/TADC_Core.cpp
@@ -383,7 +383,7 @@ int TADC_GetHashReqID(unsigned char *inBuffer, unsigned char *hashReqID)
 }
 
 int TADC_GetResponseRO(unsigned char *inBuffer, T_ROACQ_INFO *t_ROAcqInfo,
-                                          T_RO *t_RO, unsigned char *outBuffer)
+                          T_RO *t_RO, unsigned char *outBuffer, unsigned int outBufferLen)
 {
        int nHMacSize = 28; // Base64 Enc length of SHA1 20byte
        TADC_U8 sha1_tmp[20] = {0, };
@@ -426,7 +426,7 @@ int TADC_GetResponseRO(unsigned char *inBuffer, T_ROACQ_INFO *t_ROAcqInfo,
        IF_TRUE_RETURN(t_RO == NULL, TADC_PARAMETER_ERROR);
 
        nSize = TADC_IF_StrLen((char *)inBuffer);
-       IF_TRUE_RETURN(nSize <= 40 || nSize > RESP_MAXSIZE, TADC_PARAMETER_ERROR);
+       IF_TRUE_RETURN(nSize <= 40 || nSize > RESP_MAXSIZE || nSize >= (int)outBufferLen, TADC_PARAMETER_ERROR);
 
        IF_TRUE_RETURN(t_ROAcqInfo->t_DHInfo.pSize <= 0 ||
                                   t_ROAcqInfo->t_DHInfo.pSize > DHKey_SIZE, TADC_PARAMETER_ERROR);

diff --git a/tadcore/include/TADC_Core.h b/tadcore/include/TADC_Core.h
index 14ccd4c..a92c82a 100644 (file)
--- a/tadcore/include/TADC_Core.h
+++ b/tadcore/include/TADC_Core.h
@@ -188,7 +188,7 @@ int TADC_GetROAcqInfo(unsigned char *inBuffer, T_ROACQ_INFO *t_ROAcqInfo);
 int TADC_MakeRequestRO(T_ROACQ_INFO *t_ROAcqInfo, unsigned char *outBuffer,
                                           size_t outBufferSize, unsigned char *ROVer = NULL);
 int TADC_GetResponseRO(unsigned char *inBuffer, T_ROACQ_INFO *t_ROAcqInfo,
-                                          T_RO *t_RO, unsigned char *outBuffer);
+                                          T_RO *t_RO, unsigned char *outBuffer, unsigned int outBufferLen);
 int TADC_GetResponseROInfo(LPBYTE pszXML,  T_RO *t_RO);
 int TADC_GetHashReqID(unsigned char *inBuffer, unsigned char *hashReqID);
 int TADC_GetCEK(T_DEVICE_INFO *t_DeviceInfo, T_RO *t_RODB,