You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
93 lines
4.3 KiB
93 lines
4.3 KiB
From 7c99ef8bfa024f11452311c36329eeeeece4fd74 Mon Sep 17 00:00:00 2001
|
|
From: Hauke Mehrtens <hauke.mehrtens@intel.com>
|
|
Date: Wed, 22 Jun 2016 11:41:43 +0200
|
|
Subject: [PATCH] Fix memory corruption when reading inetgers from cbor
|
|
|
|
When the cbor_value_get_*() function is called with a pointer to some int, it
|
|
should have the correct size. When we cast it to something else it is treated
|
|
as a pointer to an uint64_t in the function for example and them 64 bits gets
|
|
written to memory even with the real type is only 32 bit long. When the real
|
|
type is only 32 bit long some other memory gets overwritten. On Big endian
|
|
systems the least significant bits are cut of so in most cases 0 is read.
|
|
|
|
With this patch a value cast is used and the value is converted to the other size.
|
|
|
|
This is the same as in commit 0d64c7c95a5c11a9fb5201e729fd8c75da210c80
|
|
"security: fix reading of permission attribute from configuration"
|
|
|
|
Change-Id: If5965491241e25ebf60a22dc45d37d74a33cb02f
|
|
Signed-off-by: Hauke Mehrtens <hauke.mehrtens@intel.com>
|
|
---
|
|
resource/csdk/security/src/pconfresource.c | 5 ++++-
|
|
resource/csdk/stack/src/ocpayloadparse.c | 19 +++++++++++++++----
|
|
2 files changed, 19 insertions(+), 5 deletions(-)
|
|
|
|
--- a/resource/csdk/security/src/pconfresource.c
|
|
+++ b/resource/csdk/security/src/pconfresource.c
|
|
@@ -507,8 +507,11 @@ OCStackResult CBORPayloadToPconf(const u
|
|
|
|
while (cbor_value_is_valid(&prm))
|
|
{
|
|
- cborFindResult = cbor_value_get_int(&prm, (int *)&pconf->prm[i++]);
|
|
+ int prm_val;
|
|
+
|
|
+ cborFindResult = cbor_value_get_int(&prm, &prm_val);
|
|
VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed to get value");
|
|
+ pconf->prm[i++] = (OicSecPrm_t)prm_val;
|
|
cborFindResult = cbor_value_advance(&prm);
|
|
VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed to advance value");
|
|
}
|
|
--- a/resource/csdk/stack/src/ocpayloadparse.c
|
|
+++ b/resource/csdk/stack/src/ocpayloadparse.c
|
|
@@ -287,6 +287,8 @@ static OCStackResult OCParseDiscoveryPay
|
|
|
|
while (cbor_value_is_map(&resourceMap))
|
|
{
|
|
+ int bitmap;
|
|
+
|
|
resource = (OCResourcePayload *)OICCalloc(1, sizeof(OCResourcePayload));
|
|
VERIFY_PARAM_NON_NULL(TAG, resource, "Failed allocating resource payload");
|
|
|
|
@@ -319,8 +321,9 @@ static OCStackResult OCParseDiscoveryPay
|
|
// Bitmap
|
|
err = cbor_value_map_find_value(&policyMap, OC_RSRVD_BITMAP, &curVal);
|
|
VERIFY_CBOR_SUCCESS(TAG, err, "to find bitmap tag");
|
|
- err = cbor_value_get_int(&curVal, (int *)&resource->bitmap);
|
|
+ err = cbor_value_get_int(&curVal, &bitmap);
|
|
VERIFY_CBOR_SUCCESS(TAG, err, "to find bitmap value");
|
|
+ resource->bitmap = (uint8_t)bitmap;
|
|
|
|
// Secure Flag
|
|
err = cbor_value_map_find_value(&policyMap, OC_RSRVD_SECURE, &curVal);
|
|
@@ -336,8 +339,11 @@ static OCStackResult OCParseDiscoveryPay
|
|
VERIFY_CBOR_SUCCESS(TAG, err, "to find port tag");
|
|
if (cbor_value_is_valid(&curVal))
|
|
{
|
|
- err = cbor_value_get_int(&curVal, (int *)&resource->port);
|
|
+ int port;
|
|
+
|
|
+ err = cbor_value_get_int(&curVal, &port);
|
|
VERIFY_CBOR_SUCCESS(TAG, err, "to find port value");
|
|
+ resource->port = (uint16_t)port;
|
|
}
|
|
|
|
err = cbor_value_advance(&resourceMap);
|
|
@@ -1170,6 +1176,7 @@ static OCStackResult OCParsePresencePayl
|
|
{
|
|
CborValue curVal;
|
|
uint64_t temp = 0;
|
|
+ uint8_t trigger;
|
|
|
|
// Sequence Number
|
|
CborError err = cbor_value_map_find_value(rootValue, OC_RSRVD_NONCE, &curVal);
|
|
@@ -1189,8 +1196,9 @@ static OCStackResult OCParsePresencePayl
|
|
// Trigger
|
|
err = cbor_value_map_find_value(rootValue, OC_RSRVD_TRIGGER, &curVal);
|
|
VERIFY_CBOR_SUCCESS(TAG, err, "Failed finding trigger tag");
|
|
- err = cbor_value_get_simple_type(&curVal, (uint8_t *)&payload->trigger);
|
|
+ err = cbor_value_get_simple_type(&curVal, &trigger);
|
|
VERIFY_CBOR_SUCCESS(TAG, err, "Failed finding trigger value");
|
|
+ payload->trigger = (OCPresenceTrigger)trigger;
|
|
|
|
// Resource type name
|
|
err = cbor_value_map_find_value(rootValue, OC_RSRVD_RESOURCE_TYPE, &curVal);
|