RYTEC
/
libiec61850
mirror of https://github.com/mz-automation/libiec61850.git
6
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

- replaced unsafe function StringUtils_createStringFromBufferInBuffer with function with length check to not exceed target buffer (LIB61850-447)

Browse Source
pull/521/head
Michael Zillgith 1 year ago
parent 7276b98c3c
commit 1f52be9dde
5 changed files with 50 additions and 33 deletions
Show Stats Download Patch File Download Diff File

3
src/common/inc/string_utilities.h
Unescape Escape View File

@ -76,6 +76,9 @@ StringUtils_createStringFromBuffer(const uint8_t* buf, int size);
LIB61850_INTERNAL char* LIB61850_INTERNAL char*
StringUtils_createStringFromBufferInBuffer(char* newString, const uint8_t* buf, int size); StringUtils_createStringFromBufferInBuffer(char* newString, const uint8_t* buf, int size);
LIB61850_INTERNAL char*
StringUtils_createStringFromBufferInBufferMax(char* newString, const uint8_t* buf, int size, int maxBufSize);
LIB61850_INTERNAL void LIB61850_INTERNAL void
StringUtils_replace(char* string, char oldChar, char newChar); StringUtils_replace(char* string, char oldChar, char newChar);

12
src/common/string_utilities.c
Unescape Escape View File

@ -109,6 +109,18 @@ StringUtils_createStringFromBufferInBuffer(char* newString, const uint8_t* buf,
return newString; return newString;
} }
char*
StringUtils_createStringFromBufferInBufferMax(char* newString, const uint8_t* buf, int size, int maxBufSize)
{
if (size >= maxBufSize)
size = maxBufSize - 1;
memcpy(newString, buf, size);
newString[size] = 0;
return newString;
}
char* char*
StringUtils_createStringInBuffer(char* newStr, int bufSize, int count, ...) StringUtils_createStringInBuffer(char* newStr, int bufSize, int count, ...)
{ {

22
src/iec61850/server/mms_mapping/mms_mapping.c
Unescape Escape View File

@ -3394,8 +3394,9 @@ mmsListObjectsAccessHandler(void* parameter, MmsGetNameListType listType, MmsDom
char* separator = strchr(variableId, '$'); char* separator = strchr(variableId, '$');
if (separator) { if (separator)
StringUtils_createStringFromBufferInBuffer(str, (uint8_t*) variableId, separator - variableId); {
StringUtils_createStringFromBufferInBufferMax(str, (uint8_t*) variableId, separator - variableId, sizeof(str));
ln = LogicalDevice_getLogicalNode(ld, str); ln = LogicalDevice_getLogicalNode(ld, str);
@ -3426,8 +3427,9 @@ mmsListObjectsAccessHandler(void* parameter, MmsGetNameListType listType, MmsDom
char* separator = strchr(variableId, '$'); char* separator = strchr(variableId, '$');
if (separator) { if (separator)
StringUtils_createStringFromBufferInBuffer(str, (uint8_t*) variableId, separator - variableId); {
StringUtils_createStringFromBufferInBufferMax(str, (uint8_t*) variableId, separator - variableId, sizeof(str));
ln = LogicalDevice_getLogicalNode(ld, str); ln = LogicalDevice_getLogicalNode(ld, str);
@ -3467,7 +3469,7 @@ mmsListObjectsAccessHandler(void* parameter, MmsGetNameListType listType, MmsDom
char str[65]; char str[65];
char subObjectBuf[65]; char subObjectBuf[65];
StringUtils_createStringFromBufferInBuffer(str, (uint8_t*) variableId, separator - variableId); StringUtils_createStringFromBufferInBufferMax(str, (uint8_t*) variableId, separator - variableId, sizeof(str));
LogicalNode* ln = LogicalDevice_getLogicalNode(ld, str); LogicalNode* ln = LogicalDevice_getLogicalNode(ld, str);
@ -3484,7 +3486,7 @@ mmsListObjectsAccessHandler(void* parameter, MmsGetNameListType listType, MmsDom
else { else {
doEnd--; doEnd--;
StringUtils_createStringFromBufferInBuffer(str, (uint8_t*) (doStart + 1), doEnd - doStart); StringUtils_createStringFromBufferInBufferMax(str, (uint8_t*) (doStart + 1), doEnd - doStart, sizeof(str));
subObjectName = StringUtils_copyStringToBufferAndReplace(doEnd + 2, subObjectBuf, '$', '.'); subObjectName = StringUtils_copyStringToBufferAndReplace(doEnd + 2, subObjectBuf, '$', '.');
} }
@ -3533,7 +3535,7 @@ mmsListObjectsAccessHandler(void* parameter, MmsGetNameListType listType, MmsDom
char* subObjectName = NULL; char* subObjectName = NULL;
char subObjectBuf[65]; char subObjectBuf[65];
StringUtils_createStringFromBufferInBuffer(str, (uint8_t*) variableId, separator - variableId); StringUtils_createStringFromBufferInBufferMax(str, (uint8_t*) variableId, separator - variableId, sizeof(str));
LogicalNode* ln = LogicalDevice_getLogicalNode(ld, str); LogicalNode* ln = LogicalDevice_getLogicalNode(ld, str);
@ -3551,7 +3553,7 @@ mmsListObjectsAccessHandler(void* parameter, MmsGetNameListType listType, MmsDom
else { else {
doEnd--; doEnd--;
StringUtils_createStringFromBufferInBuffer(str, (uint8_t*) (doStart + 1), doEnd - doStart); StringUtils_createStringFromBufferInBufferMax(str, (uint8_t*) (doStart + 1), doEnd - doStart, sizeof(str));
subObjectName = StringUtils_copyStringToBufferAndReplace(doEnd + 2, subObjectBuf, '$', '.'); subObjectName = StringUtils_copyStringToBufferAndReplace(doEnd + 2, subObjectBuf, '$', '.');
} }
@ -3684,7 +3686,7 @@ mmsReadAccessHandler (void* parameter, MmsDomain* domain, char* variableId, MmsS
{ {
char str[65]; char str[65];
StringUtils_createStringFromBufferInBuffer(str, (uint8_t*) variableId, separator - variableId); StringUtils_createStringFromBufferInBufferMax(str, (uint8_t*) variableId, separator - variableId, sizeof(str));
LogicalNode* ln = LogicalDevice_getLogicalNode(ld, str); LogicalNode* ln = LogicalDevice_getLogicalNode(ld, str);
@ -3704,7 +3706,7 @@ mmsReadAccessHandler (void* parameter, MmsDomain* domain, char* variableId, MmsS
{ {
doEnd--; doEnd--;
StringUtils_createStringFromBufferInBuffer(str, (uint8_t*) (doStart + 1), doEnd - doStart); StringUtils_createStringFromBufferInBufferMax(str, (uint8_t*) (doStart + 1), doEnd - doStart, sizeof(str));
} }
if (fc == IEC61850_FC_SP) if (fc == IEC61850_FC_SP)

6
src/mms/iso_mms/client/mms_client_identify.c
Unescape Escape View File

@ -84,15 +84,15 @@ mmsClient_parseIdentifyResponse(MmsConnection self, ByteBuffer* response, uint32
switch (tag) { switch (tag) {
case 0x80: /* vendorName */ case 0x80: /* vendorName */
vendorName = StringUtils_createStringFromBufferInBuffer(vendorNameBuf, buffer + bufPos, length); vendorName = StringUtils_createStringFromBufferInBufferMax(vendorNameBuf, buffer + bufPos, length, sizeof(vendorNameBuf));
bufPos += length; bufPos += length;
break; break;
case 0x81: /* modelName */ case 0x81: /* modelName */
modelName = StringUtils_createStringFromBufferInBuffer(modelNameBuf, buffer + bufPos, length); modelName = StringUtils_createStringFromBufferInBufferMax(modelNameBuf, buffer + bufPos, length, sizeof(modelNameBuf));
bufPos += length; bufPos += length;
break; break;
case 0x82: /* revision */ case 0x82: /* revision */
revision = StringUtils_createStringFromBufferInBuffer(revisionBuf, buffer + bufPos, length); revision = StringUtils_createStringFromBufferInBufferMax(revisionBuf, buffer + bufPos, length, sizeof (revisionBuf));
bufPos += length; bufPos += length;
break; break;
case 0x83: /* list of abstract syntaxes */ case 0x83: /* list of abstract syntaxes */

40
src/mms/iso_mms/server/mms_named_variable_list_service.c
Unescape Escape View File

@ -401,13 +401,13 @@ createNamedVariableList(MmsServer server, MmsDomain* domain, MmsDevice* device,
char variableName[65]; char variableName[65];
char domainId[65]; char domainId[65];
StringUtils_createStringFromBufferInBuffer(variableName, StringUtils_createStringFromBufferInBufferMax(variableName,
varSpec->choice.name.choice.domainspecific.itemId.buf, varSpec->choice.name.choice.domainspecific.itemId.buf,
varSpec->choice.name.choice.domainspecific.itemId.size); varSpec->choice.name.choice.domainspecific.itemId.size, sizeof(variableName));
StringUtils_createStringFromBufferInBuffer(domainId, StringUtils_createStringFromBufferInBufferMax(domainId,
varSpec->choice.name.choice.domainspecific.domainId.buf, varSpec->choice.name.choice.domainspecific.domainId.buf,
varSpec->choice.name.choice.domainspecific.domainId.size); varSpec->choice.name.choice.domainspecific.domainId.size, sizeof(domainId));
MmsDomain* elementDomain = MmsDevice_getDomain(device, domainId); MmsDomain* elementDomain = MmsDevice_getDomain(device, domainId);
@ -494,9 +494,9 @@ mmsServer_handleDefineNamedVariableListRequest(
goto exit_free_struct; goto exit_free_struct;
} }
StringUtils_createStringFromBufferInBuffer(domainName, StringUtils_createStringFromBufferInBufferMax(domainName,
request->variableListName.choice.domainspecific.domainId.buf, request->variableListName.choice.domainspecific.domainId.buf,
request->variableListName.choice.domainspecific.domainId.size); request->variableListName.choice.domainspecific.domainId.size, sizeof(domainName));
MmsDomain* domain = MmsDevice_getDomain(device, domainName); MmsDomain* domain = MmsDevice_getDomain(device, domainName);
@ -517,9 +517,9 @@ mmsServer_handleDefineNamedVariableListRequest(
goto exit_free_struct; goto exit_free_struct;
} }
StringUtils_createStringFromBufferInBuffer(variableListName, StringUtils_createStringFromBufferInBufferMax(variableListName,
request->variableListName.choice.domainspecific.itemId.buf, request->variableListName.choice.domainspecific.itemId.buf,
request->variableListName.choice.domainspecific.itemId.size); request->variableListName.choice.domainspecific.itemId.size, sizeof(variableListName));
if (MmsDomain_getNamedVariableList(domain, variableListName) != NULL) { if (MmsDomain_getNamedVariableList(domain, variableListName) != NULL) {
mmsMsg_createServiceErrorPdu(invokeId, response, MMS_ERROR_DEFINITION_OBJECT_EXISTS); mmsMsg_createServiceErrorPdu(invokeId, response, MMS_ERROR_DEFINITION_OBJECT_EXISTS);
@ -567,9 +567,9 @@ mmsServer_handleDefineNamedVariableListRequest(
goto exit_free_struct; goto exit_free_struct;
} }
StringUtils_createStringFromBufferInBuffer(variableListName, StringUtils_createStringFromBufferInBufferMax(variableListName,
request->variableListName.choice.aaspecific.buf, request->variableListName.choice.aaspecific.buf,
request->variableListName.choice.aaspecific.size); request->variableListName.choice.aaspecific.size, sizeof(variableListName));
if (MmsServerConnection_getNamedVariableList(connection, variableListName) != NULL) { if (MmsServerConnection_getNamedVariableList(connection, variableListName) != NULL) {
mmsMsg_createServiceErrorPdu(invokeId, response, MMS_ERROR_DEFINITION_OBJECT_EXISTS); mmsMsg_createServiceErrorPdu(invokeId, response, MMS_ERROR_DEFINITION_OBJECT_EXISTS);
@ -611,9 +611,9 @@ mmsServer_handleDefineNamedVariableListRequest(
goto exit_free_struct; goto exit_free_struct;
} }
StringUtils_createStringFromBufferInBuffer(variableListName, StringUtils_createStringFromBufferInBufferMax(variableListName,
request->variableListName.choice.vmdspecific.buf, request->variableListName.choice.vmdspecific.buf,
request->variableListName.choice.vmdspecific.size); request->variableListName.choice.vmdspecific.size, sizeof(variableListName));
if (mmsServer_getNamedVariableListWithName(MmsDevice_getNamedVariableLists(connection->server->device), variableListName) != NULL) { if (mmsServer_getNamedVariableListWithName(MmsDevice_getNamedVariableLists(connection->server->device), variableListName) != NULL) {
mmsMsg_createServiceErrorPdu(invokeId, response, MMS_ERROR_DEFINITION_OBJECT_EXISTS); mmsMsg_createServiceErrorPdu(invokeId, response, MMS_ERROR_DEFINITION_OBJECT_EXISTS);
@ -758,11 +758,11 @@ mmsServer_handleGetNamedVariableListAttributesRequest(
goto exit_function; goto exit_function;
} }
StringUtils_createStringFromBufferInBuffer(domainName, request->choice.domainspecific.domainId.buf, StringUtils_createStringFromBufferInBufferMax(domainName, request->choice.domainspecific.domainId.buf,
request->choice.domainspecific.domainId.size); request->choice.domainspecific.domainId.size, sizeof(domainName));
StringUtils_createStringFromBufferInBuffer(itemName, request->choice.domainspecific.itemId.buf, StringUtils_createStringFromBufferInBufferMax(itemName, request->choice.domainspecific.itemId.buf,
request->choice.domainspecific.itemId.size); request->choice.domainspecific.itemId.size, sizeof(itemName));
MmsDevice* mmsDevice = MmsServer_getDevice(connection->server); MmsDevice* mmsDevice = MmsServer_getDevice(connection->server);
@ -809,8 +809,8 @@ mmsServer_handleGetNamedVariableListAttributesRequest(
goto exit_function; goto exit_function;
} }
StringUtils_createStringFromBufferInBuffer(listName, request->choice.aaspecific.buf, StringUtils_createStringFromBufferInBufferMax(listName, request->choice.aaspecific.buf,
request->choice.aaspecific.size); request->choice.aaspecific.size, sizeof(listName));
MmsNamedVariableList varList = MmsServerConnection_getNamedVariableList(connection, listName); MmsNamedVariableList varList = MmsServerConnection_getNamedVariableList(connection, listName);
@ -847,8 +847,8 @@ mmsServer_handleGetNamedVariableListAttributesRequest(
goto exit_function; goto exit_function;
} }
StringUtils_createStringFromBufferInBuffer(listName, request->choice.vmdspecific.buf, StringUtils_createStringFromBufferInBufferMax(listName, request->choice.vmdspecific.buf,
request->choice.vmdspecific.size); request->choice.vmdspecific.size, sizeof(listName));
MmsDevice* mmsDevice = MmsServer_getDevice(connection->server); MmsDevice* mmsDevice = MmsServer_getDevice(connection->server);

Write Preview
Loading…
Cancel
Save