sensord: fix memory allocation to set string attribute to sensor

Change-Id: If6f846a5bfd4149deb12fee58b2ac7b9914242af
Signed-off-by: kibak.yoon <kibak.yoon@samsung.com>

diff --git a/src/client/sensor_listener.cpp b/src/client/sensor_listener.cpp
index 76c82e0..f20c3d1 100644 (file)
--- a/src/client/sensor_listener.cpp
+++ b/src/client/sensor_listener.cpp
@@ -385,25 +385,30 @@ int sensor_listener::set_attribute(int attribute, const char *value, int len)
 {
        ipc::message msg;
        ipc::message reply;
-       cmd_listener_attr_str_t buf;
+       cmd_listener_attr_str_t *buf;
+       size_t size;
 
        retvm_if(!m_cmd_channel, -EIO, "Failed to connect to server");
 
-       msg.set_type(CMD_LISTENER_ATTR_STR);
-       buf.listener_id = m_id;
-       buf.attribute = attribute;
+       size = sizeof(cmd_listener_attr_str_t) + len;
 
-       buf.value = new(std::nothrow) char[len];
-       retvm_if(!buf.value, -ENOMEM, "Failed to allocate memory");
+       buf = (cmd_listener_attr_str_t *) new(std::nothrow) char[size];
+       retvm_if(!buf, -ENOMEM, "Failed to allocate memory");
 
-       memcpy(buf.value, value, len);
-       buf.len = len;
+       msg.set_type(CMD_LISTENER_ATTR_STR);
+       buf->listener_id = m_id;
+       buf->attribute = attribute;
+
+       memcpy(buf->value, value, len);
+       buf->len = len;
 
-       msg.enclose((char *)&buf, sizeof(buf) + len);
+       msg.enclose((char *)buf, size);
 
        m_cmd_channel->send_sync(&msg);
        m_cmd_channel->read_sync(reply);
 
+       delete [] buf;
+
        return reply.header()->err;
 }
 

diff --git a/src/sensorctl/testcase/sensor_listener.cpp b/src/sensorctl/testcase/sensor_listener.cpp
index f92d33a..ebff117 100644 (file)
--- a/src/sensorctl/testcase/sensor_listener.cpp
+++ b/src/sensorctl/testcase/sensor_listener.cpp
@@ -223,3 +223,26 @@ TESTCASE(sensor_listener, bad_disconnect_p_2)
 
        return true;
 }
+
+#define TEST_STRING "TESTTESTTEST"
+#define TEST_STRING_LEN 12
+
+TESTCASE(sensor_listener, attribute_string_1)
+{
+       int err;
+       bool ret;
+       int handle;
+       sensor_t sensor;
+
+       err = sensord_get_default_sensor(ACCELEROMETER_SENSOR, &sensor);
+       ASSERT_EQ(err, 0);
+
+       handle = sensord_connect(sensor);
+       err = sensord_set_attribute_str(handle, 1, TEST_STRING, TEST_STRING_LEN);
+       ASSERT_EQ(err, 0);
+
+       ret = sensord_disconnect(handle);
+       ASSERT_TRUE(ret);
+
+       return true;
+}

diff --git a/src/server/sensor_listener_proxy.cpp b/src/server/sensor_listener_proxy.cpp
index 2a704cd..8d3c3bc 100644 (file)
--- a/src/server/sensor_listener_proxy.cpp
+++ b/src/server/sensor_listener_proxy.cpp
@@ -173,7 +173,7 @@ int sensor_listener_proxy::set_attribute(int attribute, const char *value, int l
        sensor_handler *sensor = m_manager->get_sensor(m_uri);
        retv_if(!sensor, -EINVAL);
 
-       _D("Listener[%d] try to set attribute[%d, %s]", get_id(), attribute, value);
+       _D("Listener[%d] try to set string attribute[%d], len[%d]", get_id(), attribute, len);
 
        return sensor->set_attribute(this, attribute, value, len);
 }

diff --git a/src/server/server_channel_handler.cpp b/src/server/server_channel_handler.cpp
index 2188c61..ff66ec3 100644 (file)
--- a/src/server/server_channel_handler.cpp
+++ b/src/server/server_channel_handler.cpp
@@ -237,19 +237,34 @@ int server_channel_handler::listener_attr_int(channel *ch, message &msg)
 
 int server_channel_handler::listener_attr_str(channel *ch, message &msg)
 {
-       cmd_listener_attr_str_t buf;
-       msg.disclose((char *)&buf);
-       uint32_t id = buf.listener_id;
+       uint32_t id;
+       cmd_listener_attr_str_t *buf;
+
+       buf = (cmd_listener_attr_str_t *) new(std::nothrow) char[msg.size()];
+       retvm_if(!buf, -ENOMEM, "Failed to allocate memory");
 
+       msg.disclose((char *)buf);
+
+       id = buf->listener_id;
        auto it = m_listeners.find(id);
-       retv_if(it == m_listeners.end(), -EINVAL);
-       retvm_if(!has_privileges(ch->get_fd(), m_listeners[id]->get_required_privileges()),
-                       -EACCES, "Permission denied[%d, %s]",
-                       id, m_listeners[id]->get_required_privileges().c_str());
+       if (it == m_listeners.end()) {
+               delete [] buf;
+               return -EINVAL;
+       }
 
-       int ret = m_listeners[id]->set_attribute(buf.attribute, buf.value, buf.len);
-       retv_if(ret < 0, ret);
+       if (!has_privileges(ch->get_fd(), m_listeners[id]->get_required_privileges())) {
+               _E("Permission denied[%d, %s]", id, m_listeners[id]->get_required_privileges().c_str());
+               delete [] buf;
+               return -EACCES;
+       }
+
+       int ret = m_listeners[id]->set_attribute(buf->attribute, buf->value, buf->len);
+       if (ret < 0) {
+               delete [] buf;
+               return ret;
+       }
 
+       delete [] buf;
        return send_reply(ch, OP_SUCCESS);
 }