osaf/services/saf/immsv/immloadd/imm_loader.cc | 69 ++++++++++++++++++++-----
1 files changed, 55 insertions(+), 14 deletions(-)
DNs and attribute names could be partially loaded due to buffer size in libxml.
The patch merges character fragments.
diff --git a/osaf/services/saf/immsv/immloadd/imm_loader.cc
b/osaf/services/saf/immsv/immloadd/imm_loader.cc
--- a/osaf/services/saf/immsv/immloadd/imm_loader.cc
+++ b/osaf/services/saf/immsv/immloadd/imm_loader.cc
@@ -817,6 +817,15 @@ static void startElementHandler(void* us
}
else if (strcmp((const char*)name, "dn") == 0)
{
+ assert(state->depth > 0);
+ assert(state->objectName == NULL);
+
+ if (state->state[state->depth - 1] != OBJECT)
+ {
+ LOG_ER("DN not immediately inside an object tag");
+ exit(1);
+ }
+
state->state[state->depth] = DN;
/* <attr> */
}
@@ -835,6 +844,15 @@ static void startElementHandler(void* us
}
else if (strcmp((const char*)name, "name") == 0)
{
+ assert(state->depth > 0);
+ assert(state->attrName == NULL);
+
+ if (state->state[state->depth - 1] != ATTRIBUTE &&
state->state[state->depth - 1] != RDN)
+ {
+ LOG_ER("Name not immediately inside an attribute tag");
+ exit(1);
+ }
+
state->state[state->depth] = NAME;
/* <value> */
}
@@ -1262,21 +1280,38 @@ static void charactersHandler(void* user
case ATTRIBUTE:
break;
case DN:
- /* Copy the distinguished name */
- assert(len < SA_MAX_NAME_LENGTH);
- state->objectName = (char*)malloc((size_t)len + 1);
-
- strncpy(state->objectName, (const char*)chars, (size_t)len);
-
- state->objectName[len] = '\0';
+ if (len >= SA_MAX_NAME_LENGTH)
+ {
+ LOG_ER("DN is too long (%d characters)", len);
+ exit(1);
+ }
+
+ /* Copy the distinguished name */
+ if(state->objectName)
+ {
+ state->objectName = (char *)realloc(state->objectName,
strlen(state->objectName) + len + 1);
+ if (state->attrName == NULL)
+ {
+ LOG_ER("Failed to realloc state->objectName");
+ exit(1);
+ }
+ strncat(state->objectName, (const char*)chars, (size_t)len);
+ }
+ else
+ {
+ state->objectName = (char*)malloc((size_t)len + 1);
+ if (state->attrName == NULL)
+ {
+ LOG_ER("Failed to malloc state->objectName");
+ exit(1);
+ }
+ strncpy(state->objectName, (const char*)chars, (size_t)len);
+ state->objectName[len] = '\0';
+ }
break;
case NAME:
- /* The attrName must be NULL */
- assert(!state->attrName);
-
- if (state->state[state->depth - 1] == ATTRIBUTE ||
- state->state[state->depth - 1] == RDN)
+ if (!state->attrName)
{
state->attrName = (char*)malloc((size_t)len + 1);
if (state->attrName == NULL)
@@ -1290,8 +1325,14 @@ static void charactersHandler(void* user
}
else
{
- LOG_ER("Name not immediately inside an attribute tag");
- exit(1);
+ state->attrName = (char*)realloc(state->attrName,
strlen(state->attrName) + len + 1);
+ if (state->attrName == NULL)
+ {
+ LOG_ER("Failed to realloc state->attrName");
+ exit(1);
+ }
+
+ strncat(state->attrName, (const char*)chars, len);
}
break;
case VALUE:
------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
_______________________________________________
Opensaf-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensaf-devel
