diff options
| author | Jihoon Kim <jihoon48.kim@samsung.com> | 2016-06-15 18:51:22 +0900 |
|---|---|---|
| committer | Jihoon Kim <jihoon48.kim@samsung.com> | 2016-06-15 18:53:53 +0900 |
| commit | a03fe42de7fc3f70efe90c160585d95f4db11d2d (patch) | |
| tree | 0b3563e1714e07416a3c9c6e5f2c08c83cbdf4cd | |
| parent | 05234f801e977a40719c92b080e98f97aefe1d50 (diff) | |
| download | isf-a03fe42de7fc3f70efe90c160585d95f4db11d2d.tar.gz isf-a03fe42de7fc3f70efe90c160585d95f4db11d2d.tar.bz2 isf-a03fe42de7fc3f70efe90c160585d95f4db11d2d.zip | |
Fix issues detected by static analysis tool
Return value of a function 'find_ic' is dereferenced at wayland_panel_agent_module.cpp without checking, but it is usually checked for this function.
Buffer overflow is possible by index 'len' at scim_helper.cpp:1999, because 'readlink' may return 512.
Change-Id: I8966a69b150acb9778844e856a1e4695c68b0881
| -rw-r--r-- | ism/modules/panelagent/wayland/wayland_panel_agent_module.cpp | 3 | ||||
| -rw-r--r-- | ism/src/scim_helper.cpp | 4 |
2 files changed, 4 insertions, 3 deletions
diff --git a/ism/modules/panelagent/wayland/wayland_panel_agent_module.cpp b/ism/modules/panelagent/wayland/wayland_panel_agent_module.cpp index 77f31048..a4d64e87 100644 --- a/ism/modules/panelagent/wayland/wayland_panel_agent_module.cpp +++ b/ism/modules/panelagent/wayland/wayland_panel_agent_module.cpp @@ -2718,7 +2718,8 @@ public: socket_helper_get_surrounding_text (int id, uint32 context_id, uint32 maxlen_before, uint32 maxlen_after, const int fd) { LOGD ("client id:%d, fd:%d", id, fd); WSCContextISF* ic = find_ic (context_id); - wl_input_method_context_get_surrounding_text(ic->im_ctx, maxlen_before, maxlen_after, fd); + if (ic) + wl_input_method_context_get_surrounding_text(ic->im_ctx, maxlen_before, maxlen_after, fd); } void diff --git a/ism/src/scim_helper.cpp b/ism/src/scim_helper.cpp index 760812a4..c43b6efe 100644 --- a/ism/src/scim_helper.cpp +++ b/ism/src/scim_helper.cpp @@ -2014,7 +2014,7 @@ HelperAgent::get_surrounding_text (int maxlen_before, int maxlen_after, String & if (fds[1]) { char buff[512]; - int len = read (fds[1], buff, sizeof(buff)); + int len = read (fds[1], buff, sizeof(buff) - 1); if (len <= 0) break; else { @@ -2133,7 +2133,7 @@ HelperAgent::get_selection_text (String &text) if (fds[1]) { char buff[512]; - int len = read (fds[1], buff, sizeof(buff)); + int len = read (fds[1], buff, sizeof(buff) - 1); if (len <= 0) break; else { |