firebird/firebird-mirror
firebird/firebird-mirror
8
0
Fork 1
mirror of https://github.com/FirebirdSQL/firebird.git synced 2025-01-24 00:03:03 +01:00
Code Issues

1. Fixed potential buffer overflow in gds__prefix* family of functions.

Browse Source 
2. Changed second parameter declaration to be const.
This commit is contained in:
alexpeshkoff 2003-04-06 11:40:29 +00:00
parent 982e623dfd
commit 86e6b77b50
7 changed files with 57 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/gpre/ftn.cpp
View File

@ -24,7 +24,7 @@
// //
//____________________________________________________________ //____________________________________________________________
// //
// $Id: ftn.cpp,v 1.19 2003-03-27 17:15:45 brodsom Exp $ // $Id: ftn.cpp,v 1.20 2003-04-06 11:40:29 alexpeshkoff Exp $
// //
// 2002.10.28 Sean Leyne - Completed removal of obsolete "DGUX" port // 2002.10.28 Sean Leyne - Completed removal of obsolete "DGUX" port
// 2002.10.28 Sean Leyne - Completed removal of obsolete "SGI" port // 2002.10.28 Sean Leyne - Completed removal of obsolete "SGI" port
@ -1542,7 +1542,7 @@ static void gen_database_data( ACT action)
TPB tpb; TPB tpb;
GPRE_REQ request; GPRE_REQ request;
BOOLEAN any_extern; BOOLEAN any_extern;
TEXT include_buffer[512]; TEXT include_buffer[MAXPATHLEN];
ISC_prefix(include_buffer, INCLUDE_FTN_FILE); ISC_prefix(include_buffer, INCLUDE_FTN_FILE);
sprintf(output_buffer, INCLUDE_ISC_FTN, include_buffer); sprintf(output_buffer, INCLUDE_ISC_FTN, include_buffer);

63
src/jrd/gds.cpp
View File

@ -402,6 +402,8 @@ static void ndate(SLONG, struct tm *);
static GDS_DATE nday(struct tm *); static GDS_DATE nday(struct tm *);
static void sanitize(TEXT *); static void sanitize(TEXT *);
static void safe_concat_path(TEXT *destbuf, const TEXT *srcbuf);
/* Generic cleanup handlers */ /* Generic cleanup handlers */
typedef struct clean typedef struct clean
@ -2345,7 +2347,7 @@ SLONG API_ROUTINE gds__get_prefix(SSHORT arg_type, TEXT * passed_string)
#ifndef VMS #ifndef VMS
void API_ROUTINE gds__prefix(TEXT *resultString, TEXT *file) void API_ROUTINE gds__prefix(TEXT *resultString, const TEXT *file)
{ {
/************************************** /**************************************
* *
@ -2385,19 +2387,13 @@ void API_ROUTINE gds__prefix(TEXT *resultString, TEXT *file)
} }
} }
strcat(resultString, ib_prefix); strcat(resultString, ib_prefix);
safe_concat_path(resultString, file);
int len = strlen(resultString);
if (resultString[len - 1] != PathUtils::dir_sep) {
resultString[len] = PathUtils::dir_sep;
resultString[len + 1] = 0;
}
strcat(resultString, file);
} }
#endif /* !defined(VMS) */ #endif /* !defined(VMS) */
#ifdef VMS #ifdef VMS
void API_ROUTINE gds__prefix(TEXT * string, TEXT * root) void API_ROUTINE gds__prefix(TEXT * string, const TEXT * root)
{ {
/************************************** /**************************************
* *
@ -2447,7 +2443,7 @@ void API_ROUTINE gds__prefix(TEXT * string, TEXT * root)
#ifndef VMS #ifndef VMS
void API_ROUTINE gds__prefix_lock(TEXT * string, TEXT * root) void API_ROUTINE gds__prefix_lock(TEXT * string, const TEXT * root)
{ {
/******************************************************** /********************************************************
* *
@ -2474,19 +2470,13 @@ void API_ROUTINE gds__prefix_lock(TEXT * string, TEXT * root)
} }
} }
strcat(string, ib_prefix_lock); strcat(string, ib_prefix_lock);
safe_concat_path(string, root);
int len = strlen(string);
if (string[len - 1] != PathUtils::dir_sep) {
string[len] = PathUtils::dir_sep;
string[len + 1] = 0;
}
strcat(string, root);
} }
#endif #endif
#ifdef VMS #ifdef VMS
void API_ROUTINE gds__prefix_lock(TEXT * string, TEXT * root) void API_ROUTINE gds__prefix_lock(TEXT * string, const TEXT * root)
{ {
/************************************************ /************************************************
* *
@ -2536,7 +2526,7 @@ void API_ROUTINE gds__prefix_lock(TEXT * string, TEXT * root)
#endif #endif
#ifndef VMS #ifndef VMS
void API_ROUTINE gds__prefix_msg(TEXT * string, TEXT * root) void API_ROUTINE gds__prefix_msg(TEXT * string, const TEXT * root)
{ {
/******************************************************** /********************************************************
* *
@ -2564,18 +2554,12 @@ void API_ROUTINE gds__prefix_msg(TEXT * string, TEXT * root)
} }
} }
strcat(string, ib_prefix_msg); strcat(string, ib_prefix_msg);
safe_concat_path(string, root);
int len = strlen(string);
if (string[len - 1] != PathUtils::dir_sep) {
string[len] = PathUtils::dir_sep;
string[len + 1] = 0;
}
strcat(string, root);
} }
#endif #endif
#ifdef VMS #ifdef VMS
void API_ROUTINE gds__prefix_msg(TEXT * string, TEXT * root) void API_ROUTINE gds__prefix_msg(TEXT * string, const TEXT * root)
{ {
/************************************************ /************************************************
* *
@ -4740,6 +4724,31 @@ static void sanitize(TEXT * locale)
} }
} }
static void safe_concat_path(TEXT *resultString, const TEXT *appendString)
{
/**************************************
*
* s a f e _ c o n c a t _ p a t h
*
**************************************
*
* Functional description
* Safely appends appendString to resultString using paths rules.
* resultString must be at least MAXPATHLEN size.
*
**************************************/
int len = strlen(resultString);
if (resultString[len - 1] != PathUtils::dir_sep && len < MAXPATHLEN - 1) {
resultString[len++] = PathUtils::dir_sep;
resultString[len] = 0;
}
int alen = strlen(appendString);
if (len + alen > MAXPATHLEN - 1)
alen = MAXPATHLEN - 1 - len;
assert(alen >= 0);
memcpy(&resultString[len], appendString, alen);
resultString[len + alen] = 0;
}
#ifdef DEBUG_GDS_ALLOC #ifdef DEBUG_GDS_ALLOC
#undef gds__alloc #undef gds__alloc

6
src/jrd/gds_proto.h
View File

@ -104,9 +104,9 @@ SSHORT API_ROUTINE gds__msg_lookup(void*, USHORT, USHORT, USHORT,
int API_ROUTINE gds__msg_open(void**, TEXT*); int API_ROUTINE gds__msg_open(void**, TEXT*);
void API_ROUTINE gds__msg_put(void*, USHORT, USHORT, TEXT*, TEXT*, void API_ROUTINE gds__msg_put(void*, USHORT, USHORT, TEXT*, TEXT*,
TEXT*, TEXT*, TEXT*); TEXT*, TEXT*, TEXT*);
void API_ROUTINE gds__prefix(TEXT*, TEXT*); void API_ROUTINE gds__prefix(TEXT*, const TEXT*);
void API_ROUTINE gds__prefix_lock(TEXT*, TEXT*); void API_ROUTINE gds__prefix_lock(TEXT*, const TEXT*);
void API_ROUTINE gds__prefix_msg(TEXT*, TEXT*); void API_ROUTINE gds__prefix_msg(TEXT*, const TEXT*);
SLONG API_ROUTINE gds__get_prefix(SSHORT, TEXT*); SLONG API_ROUTINE gds__get_prefix(SSHORT, TEXT*);
STATUS API_ROUTINE gds__print_status(STATUS*); STATUS API_ROUTINE gds__print_status(STATUS*);

8
src/jrd/isc.cpp
View File

@ -36,7 +36,7 @@
* *
*/ */
/* /*
$Id: isc.cpp,v 1.32 2003-04-03 10:09:58 brodsom Exp $ $Id: isc.cpp,v 1.33 2003-04-06 11:40:25 alexpeshkoff Exp $
*/ */
#ifdef DARWIN #ifdef DARWIN
#define _STLP_CCTYPE #define _STLP_CCTYPE
@ -1216,7 +1216,7 @@ SLONG API_ROUTINE ISC_get_prefix(TEXT * passed_string)
} }
return (gds__get_prefix(arg_type, ++passed_string)); return (gds__get_prefix(arg_type, ++passed_string));
} }
void API_ROUTINE ISC_prefix(TEXT * string, TEXT * root) void API_ROUTINE ISC_prefix(TEXT * string, const TEXT * root)
{ {
/************************************** /**************************************
* *
@ -1232,7 +1232,7 @@ void API_ROUTINE ISC_prefix(TEXT * string, TEXT * root)
gds__prefix(string, root); gds__prefix(string, root);
return; return;
} }
void API_ROUTINE ISC_prefix_lock(TEXT * string, TEXT * root) void API_ROUTINE ISC_prefix_lock(TEXT * string, const TEXT * root)
{ {
/************************************** /**************************************
* *
@ -1248,7 +1248,7 @@ void API_ROUTINE ISC_prefix_lock(TEXT * string, TEXT * root)
gds__prefix_lock(string, root); gds__prefix_lock(string, root);
return; return;
} }
void API_ROUTINE ISC_prefix_msg(TEXT * string, TEXT * root) void API_ROUTINE ISC_prefix_msg(TEXT * string, const TEXT * root)
{ {
/************************************** /**************************************
* *

6
src/jrd/isc_proto.h
View File

@ -41,9 +41,9 @@ extern int INTERNAL_API_ROUTINE ISC_get_user(TEXT *, int *, int *, TEXT *,
extern SLONG ISC_get_user_group_id(TEXT *); extern SLONG ISC_get_user_group_id(TEXT *);
extern void ISC_set_user(TEXT *); extern void ISC_set_user(TEXT *);
extern SLONG API_ROUTINE ISC_get_prefix(TEXT *); extern SLONG API_ROUTINE ISC_get_prefix(TEXT *);
extern void API_ROUTINE ISC_prefix(TEXT *, TEXT *); extern void API_ROUTINE ISC_prefix(TEXT *, const TEXT *);
extern void API_ROUTINE ISC_prefix_lock(TEXT *, TEXT *); extern void API_ROUTINE ISC_prefix_lock(TEXT *, const TEXT *);
extern void API_ROUTINE ISC_prefix_msg(TEXT *, TEXT *); extern void API_ROUTINE ISC_prefix_msg(TEXT *, const TEXT *);
#ifdef VMS #ifdef VMS
extern int ISC_expand_logical_once(TEXT *, USHORT, TEXT *); extern int ISC_expand_logical_once(TEXT *, USHORT, TEXT *);

18
src/jrd/svc.cpp
View File

@ -710,7 +710,7 @@ SVC SVC_attach(USHORT service_length,
#endif #endif
{ {
#ifndef SUPERSERVER #ifndef SUPERSERVER
gds__prefix(service_path, const_cast<TEXT*>(serv->serv_executable)); gds__prefix(service_path, serv->serv_executable);
service_fork(service_path, service); service_fork(service_path, service);
#else #else
/* if service is single threaded, only call if not currently running */ /* if service is single threaded, only call if not currently running */
@ -1417,6 +1417,7 @@ void SVC_query(SVC service,
**************************************/ **************************************/
SCHAR item, *items, *end_items, *end, *p, *q; SCHAR item, *items, *end_items, *end, *p, *q;
UCHAR buffer[256]; UCHAR buffer[256];
TEXT PathBuffer[MAXPATHLEN];
USHORT l, length, version, get_flags; USHORT l, length, version, get_flags;
USHORT timeout; USHORT timeout;
@ -1541,24 +1542,21 @@ void SVC_query(SVC service,
case isc_info_svc_get_env_msg: case isc_info_svc_get_env_msg:
switch (item) { switch (item) {
case isc_info_svc_get_env: case isc_info_svc_get_env:
gds__prefix(reinterpret_cast < char *>(buffer), ""); gds__prefix(PathBuffer, "");
break; break;
case isc_info_svc_get_env_lock: case isc_info_svc_get_env_lock:
gds__prefix_lock(reinterpret_cast < char *>(buffer), ""); gds__prefix_lock(PathBuffer, "");
break; break;
case isc_info_svc_get_env_msg: case isc_info_svc_get_env_msg:
gds__prefix_msg(reinterpret_cast < char *>(buffer), ""); gds__prefix_msg(PathBuffer, "");
} }
/* Note: it is safe to use strlen to get a length of "buffer" /* Note: it is safe to use strlen to get a length of "buffer"
because gds_prefix[_lock|_msg] return a zero-terminated because gds_prefix[_lock|_msg] return a zero-terminated
string string
*/ */
if (!(info = INF_put_item(item, if (!(info = INF_put_item(item, strlen(PathBuffer),
strlen(reinterpret_cast < PathBuffer, info, end))) {
char *>(buffer)),
reinterpret_cast < char *>(buffer),
info, end))) {
THREAD_ENTER; THREAD_ENTER;
return; return;
} }
@ -2069,7 +2067,7 @@ void *SVC_start(SVC service, USHORT spb_length, SCHAR * spb)
#ifndef SUPERSERVER #ifndef SUPERSERVER
if (serv->serv_executable) { if (serv->serv_executable) {
gds__prefix(service_path, const_cast<TEXT*>(serv->serv_executable)); gds__prefix(service_path, serv->serv_executable);
service->svc_flags = SVC_forked; service->svc_flags = SVC_forked;
service_fork(service_path, service); service_fork(service_path, service);
} }

2
src/qli/help.epp
View File

@ -92,7 +92,7 @@ void HELP_help( SYN node)
**************************************/ **************************************/
NAM *ptr, *end; NAM *ptr, *end;
USHORT max_level; USHORT max_level;
TEXT target[128], **topic, *topics[16]; TEXT target[MAXPATHLEN], **topic, *topics[16];
if (!HELP_DB) { if (!HELP_DB) {
gds__prefix(target, TARGET); gds__prefix(target, TARGET);