[CONPRO-1561] Crash in memcpy 82/225282/1 accepted/tizen_5.5_unified accepted/tizen_5.5_unified_wearable_hotfix tizen_5.5 tizen_5.5_tv tizen_5.5_wearable_hotfix accepted/tizen/5.5/unified/20200224.123517 accepted/tizen/5.5/unified/wearable/hotfix/20201027.100634 submit/tizen_5.5/20200219.001653 submit/tizen_5.5/20200224.011218 submit/tizen_5.5_wearable_hotfix/20201026.184307
authorsamanway <samanway@linux-samanway.sa.corp.samsungelectronics.net>
Tue, 4 Feb 2020 11:07:38 +0000 (16:37 +0530)
committerDoHyun Pyun <dh79.pyun@samsung.com>
Wed, 19 Feb 2020 00:11:35 +0000 (09:11 +0900)
- In Caremotehandler.c, function CACloneInfo was copying token into buffer in vulnurable way
- Fixed it appending NULL in destination string

https://github.sec.samsung.net/RS7-IOTIVITY/IoTivity/pull/662
(cherry-picked from f8af2d6ca117bdf270c97c5c28f86bb0169659e5)

Change-Id: I84dfff77ecbf3a333913ce341060d7e30444ac62
Signed-off-by: samanway <samanway-dey@samsung.com>
Signed-off-by: DoHyun Pyun <dh79.pyun@samsung.com>
resource/csdk/connectivity/common/src/caremotehandler.c

index 1e5b7e9..638c04f 100644 (file)
@@ -261,7 +261,7 @@ CAResult_t CACloneInfo(const CAInfo_t *info, CAInfo_t *clone)
         // allocate token field
         uint8_t len = info->tokenLength;
 
-        char *temp = (char *) OICMalloc(len * sizeof(char));
+        char *temp = (char *) OICCalloc(1, (len + 1) * sizeof(char));
         if (!temp)
         {
             OIC_LOG(ERROR, TAG, "CACloneInfo Out of memory");