Skip to content

Commit a650fe5

Browse files
tsymiartsymiar
committed
[linxsrv] fix unsafe usages like buffer boundaries
1 parent e608606 commit a650fe5

11 files changed

Lines changed: 208 additions & 97 deletions

File tree

‎LinxSrvc/IM/IM.cc‎

Lines changed: 50 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ int main(int argc, char* argv[])
299299
inst_mssg(argc, argv);
300300
setsid();
301301
chdir("/");
302-
umask(0);
302+
umask(0077);
303303
close(STDIN_FILENO);
304304
close(STDOUT_FILENO);
305305
close(STDERR_FILENO);
@@ -952,7 +952,7 @@ type_thread_func monitor(void* arg)
952952
total += 10;
953953
break;
954954
default:
955-
snprintf((sd_bufs + offset), 15, "Unknown error.");
955+
snprintf((sd_bufs + offset), 33, "Unknown error while JOIN_ZONE.");
956956
break;
957957
}
958958
} else {
@@ -1006,7 +1006,10 @@ type_thread_func monitor(void* arg)
10061006
}//for MAX_MEMBERS_PER_GROUP
10071007
}//else val_rtn < 0
10081008
} break;
1009-
default: break;
1009+
default:
1010+
snprintf((sd_bufs + offset), 24, "Unknown command [%c].", sd_bufs[1]);
1011+
*length = total = 48;
1012+
break;
10101013
}
10111014
if ((memcmp(g_usrMsg.chk, "P2P", 4) != 0) &&
10121015
(send(cur_sock, sd_bufs, total, 0) < 0)) {
@@ -1100,9 +1103,8 @@ int inst_mssg(int argc, char* argv[])
11001103
_beginthreadex(nullptr, 0, (_beginthreadex_proc_type)commands, nullptr, 0, &threadid);
11011104
WSADATA wsaData;
11021105
if (WSAStartup(0x202, &wsaData) == SOCKET_ERROR) {
1103-
std::cerr << "WSAStartup failed with error " << WSAGetLastError() << std::endl;
1106+
std::cerr << "WSAStartup failed with error [" << WSAGetLastError() << "](" << errno << "): " << strerror(errno) << std::endl;
11041107
WSACleanup();
1105-
std::cerr << "ERROR(" << errno << "): " << strerror(errno) << std::endl;
11061108
return -1;
11071109
}
11081110
#else
@@ -1135,7 +1137,7 @@ int inst_mssg(int argc, char* argv[])
11351137
#else
11361138
< 0) {
11371139
#endif
1138-
std::cerr << "ERROR(" << errno << "): " << strerror(errno) << std::endl;
1140+
std::cerr << "ERROR(" << errno << ") bindport [" << srvPort << "]: " << strerror(errno) << std::endl;
11391141
exit(-1);
11401142
}
11411143
if (listen(listen_socket, 50)
@@ -1146,7 +1148,7 @@ int inst_mssg(int argc, char* argv[])
11461148
#else
11471149
< 0) {
11481150
#endif
1149-
std::cerr << "ERROR(" << errno << "): " << strerror(errno) << std::endl;
1151+
std::cerr << "ERROR(" << errno << ") listen [" << srvPort << "]: " << strerror(errno) << std::endl;
11501152
exit(-1);
11511153
}
11521154
int threadCnt = 0;
@@ -1174,7 +1176,7 @@ int inst_mssg(int argc, char* argv[])
11741176
#else
11751177
< 0) {
11761178
#endif // use socklen
1177-
std::cerr << "ERROR(" << errno << "," << socklen << "): " << strerror(errno) << std::endl;
1179+
std::cerr << "ERROR(" << errno << ") accept [" << socklen << "]: " << strerror(errno) << std::endl;
11781180
return -1;
11791181
} else {
11801182
char IPdotDec[16];
@@ -1206,7 +1208,7 @@ int inst_mssg(int argc, char* argv[])
12061208
#elif !defined SOCK_CONN_TEST || defined SOCK_CONN_TEST
12071209
type_socket msg_socket = accept(listen_socket, (struct sockaddr*)&fromAddr, &socklen);
12081210
if (msg_socket < 0) {
1209-
std::cerr << "ERROR(" << errno << "): " << strerror(errno) << std::endl;
1211+
std::cerr << "ERROR(" << errno << ") accept [" << listen_socket << "]: " << strerror(errno) << std::endl;
12101212
return -1;
12111213
} else {
12121214
int PID = 0;
@@ -1309,24 +1311,51 @@ void func_waitpid(int signo)
13091311
#else
13101312
ssize_t total = 0;
13111313
char* sock_0 = reinterpret_cast<char*>(&sock);
1312-
while (total < (ssize_t)sizeof(sock)) {
1313-
ssize_t len = read(g_filedes[0], sock_0 + total, sizeof(sock) - total);
1314-
if (len < 0) {
1315-
fprintf(stderr, "Read error: %s\n", strerror(errno));
1316-
break;
1314+
const ssize_t expect = sizeof(sock);
1315+
while (total < expect && total >= 0) {
1316+
ssize_t len = read(g_filedes[0], sock_0 + total, expect - total);
1317+
if (len > 0) {
1318+
if (total + len > expect) {
1319+
fprintf(stderr, "Buffer overflow prevented: expects %zd, got %zd!\n", expect, total + len);
1320+
break;
1321+
}
1322+
total += len;
1323+
continue;
13171324
}
13181325
if (len == 0) {
1319-
fprintf(stderr, "Read EOF: expects %zu, got %zd!\n", sizeof(sock), total);
1326+
fprintf(stderr, "Read EOF: expects %zd, got %zd!\n", expect, total);
13201327
break;
13211328
}
1322-
if (total + len > (ssize_t)sizeof(sock)) {
1323-
fprintf(stderr, "Buffer overflow prevented: expects %zu, got %zd!\n", sizeof(sock), total + len);
1324-
break;
1329+
// len < 0: handle transient errors specially
1330+
if (errno == EINTR) {
1331+
// interrupted by signal, retry read
1332+
continue;
13251333
}
1326-
total += len;
1334+
if (errno == EAGAIN || errno == EWOULDBLOCK) {
1335+
// no data available right now; wait briefly for readability
1336+
fd_set rfds;
1337+
FD_ZERO(&rfds);
1338+
FD_SET(g_filedes[0], &rfds);
1339+
timeval tv;
1340+
tv.tv_sec = 1;
1341+
tv.tv_usec = 0;
1342+
int sel = select(g_filedes[0] + 1, &rfds, NULL, NULL, &tv);
1343+
if (sel > 0) {
1344+
// socket ready, retry read
1345+
continue;
1346+
} else if (sel == 0) {
1347+
fprintf(stderr, "Read timeout on pipe: expects %zd, got %zd!\n", expect, total);
1348+
break;
1349+
} else {
1350+
// select error; fall through to error reporting
1351+
}
1352+
}
1353+
// fatal read error
1354+
fprintf(stderr, "Read error: %s\n", strerror(errno));
1355+
break;
13271356
}
1328-
if (total != (ssize_t)sizeof(sock)) {
1329-
fprintf(stderr, "Read size mismatch: expects %zu, got %zd!\n", sizeof(sock), total);
1357+
if (total != expect) {
1358+
fprintf(stderr, "Read size mismatch: expects %zd, got %zd!\n", expect, total);
13301359
break;
13311360
}
13321361
#endif

‎LinxSrvc/hdware/test.c‎

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,11 @@
88
#elif defined(VIDEO) || defined(SNAP)
99
#include "test.h"
1010
#elif defined(DRIVER)
11-
#include "stdio.h"
12-
#include "fcntl.h"
13-
#include "unistd.h"
11+
#include <stdio.h>
12+
#include <fcntl.h>
13+
#include <unistd.h>
14+
#include <string.h>
15+
#include <sys/stat.h>
1416
#else
1517
#error compile command unsupported
1618
#endif
@@ -44,22 +46,33 @@ int main(int argc, char** argv)
4446
#define SizeOfBuf 1024
4547
int fd = open(DEV_NODE, O_RDWR, S_IRUSR | S_IWUSR);
4648
if (fd < 0) {
47-
perror("open ["DEV_NODE"] fail");
49+
perror("open [" DEV_NODE "] fail");
4850
} else {
4951
char msg[SizeOfBuf];
50-
ssize_t len = read(fd, msg, sizeof(msg));
51-
if (len > SizeOfBuf || len < 0) {
52-
perror("beyond read size");
52+
ssize_t len = read(fd, msg, SizeOfBuf - 1);
53+
if (len < 0) {
54+
perror("read fail");
55+
close(fd);
5356
return -1;
5457
}
5558
msg[SizeOfBuf - 1] = '\0';
5659
printf("Default chars is [%s].\n", msg);
5760
printf("Please input a string written to chars device: ");
58-
scanf("%1023s", msg);
59-
write(fd, msg, sizeof(msg));
60-
len = read(fd, msg, sizeof(msg));
61-
if (len > SizeOfBuf || len < 0) {
62-
perror("beyond read size");
61+
if (scanf("%1023s", msg) != 1) {
62+
fprintf(stderr, "scanf error\n");
63+
close(fd);
64+
return -1;
65+
}
66+
ssize_t wlen = write(fd, msg, strlen(msg));
67+
if (wlen < 0) {
68+
perror("write fail");
69+
close(fd);
70+
return -1;
71+
}
72+
ssize_t rlen = read(fd, msg, SizeOfBuf - 1);
73+
if (rlen < 0) {
74+
perror("read fail");
75+
close(fd);
6376
return -1;
6477
}
6578
msg[SizeOfBuf - 1] = '\0';

‎LinxSrvc/lookup/common.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
#include <iostream>
77
#include <sys/time.h>
88

9-
#ifndef MAX_PATH_LEN
10-
#define MAX_PATH_LEN 256
9+
#ifndef MAX_NAME_LEN
10+
#define MAX_NAME_LEN 128
1111
#endif
1212

1313
#define DELETE(x) do { \
@@ -63,7 +63,7 @@ struct SeekTimeValue {
6363
#pragma pack(push)
6464
#pragma pack(4)
6565
typedef struct tagSeekTimeContent {
66-
char fileName[MAX_PATH_LEN];
66+
char fileName[MAX_NAME_LEN];
6767
uint32_t fileid = 1;
6868
uint64_t totalSize;
6969
int32_t duration;

‎LinxSrvc/lookup/seek/SeekComm.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ struct SelectFileOffset {
3030

3131
struct FileFrameData {
3232
uint32_t id;
33-
char fileName[128];
33+
char fileName[MAX_NAME_LEN];
3434
struct {
3535
int64_t timestamp;
3636
int64_t offset;

‎LinxSrvc/lookup/seek/SeekTime.cpp‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ int SeekTime::findFileFragmentDetail(FILE* file, FileFrameData& startframe, File
8181
fseek(file, curpos, SEEK_SET);
8282

8383
SeekTimeContent comidx{};
84-
memcpy(comidx.fileName, startframe.fileName, sizeof(startframe.fileName));
84+
memcpy(comidx.fileName, startframe.fileName, MAX_NAME_LEN);
8585

8686
uint8_t buffer[m_windSize];
8787
uint32_t buffSize = m_windSize > cursize ? cursize : m_windSize;
@@ -337,25 +337,25 @@ int SeekTime::seekFileDataTime(uint32_t duration, std::vector<SeekTimeContent>&
337337
}
338338
for (SelectTime& seekTime : vecFileTime.second) {
339339
SeekTimeContent fileinfo{};
340-
strncpy(fileinfo.fileName, vecFileTime.first.c_str(), MAX_PATH_LEN);
340+
snprintf(fileinfo.fileName, MAX_NAME_LEN, "%s", vecFileTime.first.c_str());
341341
LOG_INF("'%s', selecting time=%lld ...", fileinfo.fileName, seekTime.average());
342342

343343
// First check the database TblFileIdMapping for a record of this file; if not found, insert a record
344344
uint32_t fileId = 0;
345345
FileFrameData startframe{};
346346
FileFrameData tailframe{};
347-
strncpy(startframe.fileName, vecFileTime.first.c_str(), 128);
348-
strncpy(tailframe.fileName, vecFileTime.first.c_str(), 128);
347+
snprintf(startframe.fileName, MAX_NAME_LEN, "%s", vecFileTime.first.c_str());
348+
snprintf(tailframe.fileName, MAX_NAME_LEN, "%s", vecFileTime.first.c_str());
349349
startframe.target.timestamp = seekTime.first;
350350
tailframe.target.timestamp = seekTime.last;
351351
FileFrameData fileMapping{};
352352
if (m_dbMgr->queryFileIdbyName(vecFileTime.first, fileId) != 0) {
353353
SeekTimeContent headIdx{};
354354
SeekTimeContent tailIdx{};
355-
strncpy(fileMapping.fileName, vecFileTime.first.c_str(), 128);
355+
snprintf(fileMapping.fileName, MAX_NAME_LEN, "%s", vecFileTime.first.c_str());
356356
bool find = getFirstFrame(m_pfile, m_windSize, headIdx, offset);
357357
if (find) {
358-
memcpy(headIdx.fileName, vecFileTime.first.c_str(), vecFileTime.first.size());
358+
snprintf(headIdx.fileName, MAX_NAME_LEN, "%s", vecFileTime.first.c_str());
359359
fileMapping.offset.head = headIdx.value.offset;
360360
fileMapping.ftime.first = headIdx.value.timestamp;
361361
LOG_INF("getFirstFrame offset=%lld len=%lld timestamp=%lld fileid=%u", headIdx.value.offset, headIdx.value.size, headIdx.value.timestamp, headIdx.fileid);
@@ -371,7 +371,7 @@ int SeekTime::seekFileDataTime(uint32_t duration, std::vector<SeekTimeContent>&
371371
}
372372
find = getTailFrame(m_pfile, m_windSize, tailIdx);
373373
if (find) {
374-
memcpy(tailIdx.fileName, vecFileTime.first.c_str(), vecFileTime.first.size());
374+
snprintf(tailIdx.fileName, MAX_NAME_LEN, "%s", vecFileTime.first.c_str());
375375
/* Insert file information into TblFileIdMapping table */
376376
fileMapping.offset.tail = tailIdx.value.offset;
377377
fileMapping.ftime.last = tailIdx.value.timestamp;

‎LinxSrvc/lookup/time/TimeSeek.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ int TimeSeek::seekFileDataTime(std::vector<SeekTimeContent>& fileinfos)
254254
for (auto it : m_seekTimeMap) {
255255
for (auto at : it.second) {
256256
SeekTimeContent fileinfo{};
257-
snprintf(fileinfo.fileName, MAX_PATH_LEN, "%s", it.first.c_str());
257+
snprintf(fileinfo.fileName, MAX_NAME_LEN, "%s", it.first.c_str());
258258
printf("--- '%s', selecting time=%lu\n", fileinfo.fileName, at.average());
259259
// check first if time is in database
260260
if (getTimefromDatabase(m_dbMgr, at, fileinfo, fileinfos)) {
@@ -305,7 +305,7 @@ int TimeSeek::seekFileDataTime(std::vector<SeekTimeContent>& fileinfos)
305305
fileinfo = parseFileFrame(selectOffset, at.average(), m_timeDetail.offset.first);
306306
}
307307
if (fileinfo.found) {
308-
snprintf(fileinfo.fileName, MAX_PATH_LEN, "%s", it.first.c_str());
308+
snprintf(fileinfo.fileName, MAX_NAME_LEN, "%s", it.first.c_str());
309309
fileinfo.param = at.average();
310310
fileinfos.emplace_back(fileinfo);
311311
} else {

0 commit comments

Comments
 (0)