Ack from me. Not tested. /AndersBj
-----Original Message----- From: Zoran Milinkovic [mailto:[email protected]] Sent: den 3 oktober 2014 02:42 To: [email protected] Cc: [email protected] Subject: [devel] [PATCH 2 of 2] immtools: fix loading long data in immcfg [#1130] osaf/tools/safimm/immcfg/imm_import.cc | 52 ++++++++++++++++++++++++++------- 1 files changed, 41 insertions(+), 11 deletions(-) DNs and attribute names could be partially loaded due to buffer size in libxml. The patch merges character fragments. diff --git a/osaf/tools/safimm/immcfg/imm_import.cc b/osaf/tools/safimm/immcfg/imm_import.cc --- a/osaf/tools/safimm/immcfg/imm_import.cc +++ b/osaf/tools/safimm/immcfg/imm_import.cc @@ -1270,6 +1270,14 @@ static void startElementHandler(void* us /* <dn> */ } else if (strcmp((const char*)name, "dn") == 0) { + assert(state->depth > 0); + assert(state->objectName == NULL); + + if (state->state[state->depth - 1] != OBJECT) { + LOG_ER("DN not immediately inside an object tag"); + exit(1); + } + state->state[state->depth] = DN; /* <attr> */ } else if (strcmp((const char*)name, "attr") == 0) { @@ -1284,6 +1292,14 @@ static void startElementHandler(void* us state->attrDefaultValueSet = 0; /* <name> */ } else if (strcmp((const char*)name, "name") == 0) { + assert(state->depth > 0); + assert(state->attrName == NULL); + + if (state->state[state->depth - 1] != ATTRIBUTE && state->state[state->depth - 1] != RDN) { + LOG_ER("Name not immediately inside an attribute tag"); + exit(1); + } + state->state[state->depth] = NAME; /* <value> */ } else if (strcmp((const char*)name, "value") == 0) { @@ -1578,19 +1594,27 @@ static void charactersHandler(void* user case DN: /* Copy the distinguished name */ assert(len < SA_MAX_NAME_LENGTH); - state->objectName = (char*)malloc((size_t)len + 1); - strncpy(state->objectName, (const char*)chars, (size_t)len); - - state->objectName[len] = '\0'; + if(state->objectName) { + state->objectName = (char *)realloc(state->objectName, strlen(state->objectName) + len + 1); + if (state->attrName == NULL) { + LOG_ER("Failed to realloc state->objectName"); + exit(1); + } + strncat(state->objectName, (const char*)chars, (size_t)len); + } else { + state->objectName = (char*)malloc((size_t)len + 1); + if (state->attrName == NULL) { + LOG_ER("Failed to malloc state->objectName"); + exit(1); + } + strncpy(state->objectName, (const char*)chars, (size_t)len); + state->objectName[len] = '\0'; + } break; case NAME: - /* The attrName must be NULL */ - assert(!state->attrName); - - if (state->state[state->depth - 1] == ATTRIBUTE || - state->state[state->depth - 1] == RDN) { + if (!state->attrName) { state->attrName = (char*)malloc((size_t)len + 1); if (state->attrName == NULL) { LOG_ER("Failed to malloc state->attrName"); @@ -1600,8 +1624,14 @@ static void charactersHandler(void* user strncpy(state->attrName, (const char*)chars, (size_t)len); state->attrName[len] = '\0'; } else { - LOG_ER("Name not immediately inside an attribute tag"); - exit(1); + state->attrName = (char*)realloc(state->attrName, strlen(state->attrName) + len + 1); + if (state->attrName == NULL) { + LOG_ER("Failed to realloc state->attrName"); + exit(1); + } + + strncat(state->attrName, (const char*)chars, len); + } break; case VALUE: ------------------------------------------------------------------------------ Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk _______________________________________________ Opensaf-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/opensaf-devel ------------------------------------------------------------------------------ Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk _______________________________________________ Opensaf-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/opensaf-devel
