Fix keyval decode function

- Adds the exceptions
- Adds a parameter about byte size

Change-Id: I44431f68929ab9115a5e24f641614b0a159f6082
Signed-off-by: Hwankyu Jhun <h.jhun@samsung.com>

5 files changed, 74 insertions, 14 deletions

diff --git a/src/bundle.c b/src/bundle.c
index 7879a5e..c766ee9 100644
--- a/src/bundle.c
+++ b/src/bundle.c
@@ -574,11 +574,14 @@ bundle *bundle_decode(const bundle_raw *r, const int data_size)
 
 		/* Find type, and use decode function according to type */
 		type = keyval_get_type_from_encoded_byte(p_r);
-		if (keyval_type_is_array(type))
+		if (keyval_type_is_array(type)) {
 			bytes_read = keyval_array_decode(p_r,
-					(keyval_array_t **) &kv);
-		else
-			bytes_read = keyval_decode(p_r, &kv);
+					(keyval_array_t **)&kv,
+					d_r + d_len - 1 - p_r);
+		} else {
+			bytes_read = keyval_decode(p_r, &kv,
+					d_r + d_len - 1 - p_r);
+		}
 
 		if (kv)
 			_bundle_append_kv(b, kv);
@@ -716,11 +719,14 @@ bundle *bundle_decode_raw(const bundle_raw *r, const int data_size)
 
 		/* Find type, and use decode function according to type */
 		type = keyval_get_type_from_encoded_byte(p_r);
-		if (keyval_type_is_array(type))
+		if (keyval_type_is_array(type)) {
 			bytes_read = keyval_array_decode(p_r,
-					(keyval_array_t **) &kv);
-		else
-			bytes_read = keyval_decode(p_r, &kv);
+					(keyval_array_t **)&kv,
+					d_r + d_len - 1 - p_r);
+		} else {
+			bytes_read = keyval_decode(p_r, &kv,
+					d_r + d_len - 1 - p_r);
+		}
 
 		if (kv)
 			_bundle_append_kv(b, kv);
@@ -866,11 +872,11 @@ bundle *bundle_import_from_argv(int argc, char **argv)
 
 		type = keyval_get_type_from_encoded_byte(byte);
 		if (keyval_type_is_array(type)) {
-			if (keyval_array_decode(byte, &kva) == 0) /* TODO: error! */
+			if (keyval_array_decode(byte, &kva, byte_size) == 0) /* TODO: error! */
 				BUNDLE_EXCEPTION_PRINT("Unable to Decode array\n");
 			kv = (keyval_t *)kva;
 		} else {
-			if (keyval_decode(byte, &kv) == 0) /* TODO: error! */
+			if (keyval_decode(byte, &kv, byte_size) == 0) /* TODO: error! */
 				BUNDLE_EXCEPTION_PRINT("Unable to Decode\n");
 		}
 		_bundle_append_kv(b, kv);
diff --git a/src/keyval.c b/src/keyval.c
index 5a48c0e..ee069c2 100755
--- a/src/keyval.c
+++ b/src/keyval.c
@@ -210,7 +210,7 @@ size_t keyval_encode(keyval_t *kv, unsigned char **byte, size_t *byte_len)
  *                  If kv is not NULL, given kv is used. (No new kv is created.)
  * @return        Number of bytes read from byte.
  */
-size_t keyval_decode(unsigned char *byte, keyval_t **kv)
+size_t keyval_decode(unsigned char *byte, keyval_t **kv, size_t byte_size)
 {
 	static const size_t sz_byte_len = sizeof(size_t);
 	static const size_t sz_type = sizeof(int);
@@ -225,14 +225,39 @@ size_t keyval_decode(unsigned char *byte, keyval_t **kv)
 	unsigned char *p = byte;
 
 	byte_len = *((size_t *)p);
+
+	if (byte_size < sz_byte_len)
+		return 0;
+
+	byte_size -= sz_byte_len;
 	p += sz_byte_len;
 	type = *((int *)p);
+
+	if (byte_size < sz_type)
+		return 0;
+
+	byte_size -= sz_type;
 	p += sz_type;
 	keysize = *((size_t *)p);
+
+	if (byte_size < sz_keysize)
+		return 0;
+
+	byte_size -= sz_keysize;
 	p += sz_keysize;
 	key = (char *)p;
+
+	if (byte_size < keysize)
+		return 0;
+
+	byte_size -= keysize;
 	p += keysize;
 	size = *((size_t *)p);
+
+	if (byte_size < sz_size)
+		return 0;
+
+	byte_size -= sz_size;
 	p += sz_size;
 	val = (void *)p;
 	p += size;
diff --git a/src/keyval.h b/src/keyval.h
index 459c4ac..4cf3b6b 100755
--- a/src/keyval.h
+++ b/src/keyval.h
@@ -63,7 +63,7 @@ void keyval_free(keyval_t *kv, int do_free_object);
 int keyval_compare(keyval_t *kv1, keyval_t *kv2);
 size_t keyval_get_encoded_size(keyval_t *kv);
 size_t keyval_encode(keyval_t *kv, unsigned char **byte, size_t *byte_len);
-size_t keyval_decode(unsigned char *byte, keyval_t **kv);
+size_t keyval_decode(unsigned char *byte, keyval_t **kv, size_t byte_size);
 int keyval_get_data(keyval_t *kv, int *type, void **val, size_t *size);
 int keyval_get_type_from_encoded_byte(unsigned char *byte);
 
diff --git a/src/keyval_array.c b/src/keyval_array.c
index b9d9886..db9d9c0 100755
--- a/src/keyval_array.c
+++ b/src/keyval_array.c
@@ -319,7 +319,7 @@ size_t keyval_array_encode(keyval_array_t *kva, void **byte, size_t *byte_len)
 	return *byte_len;
 }
 
-size_t keyval_array_decode(void *byte, keyval_array_t **kva)
+size_t keyval_array_decode(void *byte, keyval_array_t **kva, size_t byte_size)
 {
 	static const size_t sz_byte_len = sizeof(size_t);
 	static const size_t sz_type = sizeof(int);
@@ -338,16 +338,45 @@ size_t keyval_array_decode(void *byte, keyval_array_t **kva)
 
 	/* Get data */
 	byte_len = *((size_t *)p);
+
+	if (byte_size < sz_byte_len)
+		return 0;
+
+	byte_size -= sz_byte_len;
 	p += sz_byte_len;
 	type = *((int *)p);
+
+	if (byte_size < sz_type)
+		return 0;
+
+	byte_size -= sz_type;
 	p += sz_type;
 	keysize = *((size_t *)p);
+
+	if (byte_size < sz_keysize)
+		return 0;
+
+	byte_size -= sz_keysize;
 	p += sz_keysize;
 	key = (char *)p;
+
+	if (byte_size < keysize)
+		return 0;
+
+	byte_size -= keysize;
 	p += keysize;
 	len = *((unsigned int *)p);
+
+	if (byte_size < sz_len)
+		return 0;
+
+	byte_size -= sz_len;
 	p += sz_len;
 	array_element_size = (size_t *)p;
+
+	if (byte_size < (sizeof(size_t) * len))
+		return 0;
+
 	p += sizeof(size_t) * len;
 	array_val = (void *)p;
 
diff --git a/src/keyval_array.h b/src/keyval_array.h
index 47b38a9..510a1c8 100755
--- a/src/keyval_array.h
+++ b/src/keyval_array.h
@@ -38,7 +38,7 @@ void keyval_array_free(keyval_array_t *kva, int do_free_object);
 int keyval_array_compare(keyval_array_t *kva1, keyval_array_t *kva2);
 size_t keyval_array_get_encoded_size(keyval_array_t *kva);
 size_t keyval_array_encode(keyval_array_t *kva, void **byte, size_t *byte_len);
-size_t keyval_array_decode(void *byte, keyval_array_t **kva);
+size_t keyval_array_decode(void *byte, keyval_array_t **kva, size_t byte_size);
 int keyval_array_copy_array(keyval_array_t *kva, void **array_val,
 		unsigned int array_len, size_t (*measure_val_len)(void * val));
 int keyval_array_get_data(keyval_array_t *kva, int *type, void ***array_val,