usergreen
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Pull Requests Activity

Evas/cserve2: Add some safety checks when reading socket messages 

Fixes CID 1039571 and 1039572.
This commit is contained in:
Jean-Philippe Andre 2014-01-14 17:36:54 +09:00
parent d8d5189003
commit 137383b532
3 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/bin/evas/dummy_slave.c
View File

@ -23,6 +23,10 @@ command_read(int fd, Slave_Command *cmd, void **params)
if (ret < (int)sizeof(int) * 2)
return EINA_FALSE;
if(!((ints[0] > 0) && (ints[0] <= 0xFFFF) &&
(ints[1] >= 0) && (ints[1] < SLAVE_COMMAND_LAST)))
return EINA_FALSE;
size = ints[0];
buf = malloc(size);
if (!buf) return EINA_FALSE;

3
src/bin/evas/evas_cserve2.h
View File

@ -99,7 +99,8 @@ typedef enum {
FONT_LOAD,
FONT_GLYPHS_LOAD,
SLAVE_QUIT,
ERROR
ERROR,
SLAVE_COMMAND_LAST
} Slave_Command;
struct _Slave_Msg_Image_Open {

3
src/bin/evas/evas_cserve2_slave.c
View File

@ -188,6 +188,9 @@ command_read(int fd, Slave_Command *cmd, void **params)
if (ret < (int)sizeof(int) * 2)
return EINA_FALSE;
EINA_SAFETY_ON_FALSE_RETURN_VAL((ints[0] > 0) && (ints[0] <= 0xFFFF), EINA_FALSE);
EINA_SAFETY_ON_FALSE_RETURN_VAL((ints[1] >= 0) && (ints[1] < SLAVE_COMMAND_LAST), EINA_FALSE);
size = ints[0];
buf = malloc(size);
if (!buf) return EINA_FALSE;