GENDLT-15, Safe re-allocations for databuffer.

Signed-off-by: Christian Muck <christian.muck@bmw.de>

4 files changed, 46 insertions, 17 deletions

diff --git a/src/daemon/dlt-daemon.c b/src/daemon/dlt-daemon.c
index 79d8bea..04612bb 100755
--- a/src/daemon/dlt-daemon.c
+++ b/src/daemon/dlt-daemon.c
@@ -1527,11 +1527,15 @@ int dlt_daemon_process_user_message_register_context(DltDaemon *daemon, DltDaemo
         }
 
         msg.datasize = sizeof(DltServiceGetLogInfoRequest);
-        if (msg.databuffer)
+        if (msg.databuffer && (msg.databuffersize < msg.datasize))
         {
             free(msg.databuffer);
+            msg.databuffer=0;
+        }
+        if (msg.databuffer == 0){
+        	msg.databuffer = (uint8_t *) malloc(msg.datasize);
+        	msg.databuffersize = msg.datasize;
         }
-        msg.databuffer = (uint8_t *) malloc(msg.datasize);
         if (msg.databuffer==0)
         {
         	dlt_log(LOG_ERR,"Can't allocate buffer for get log info message\n");
diff --git a/src/daemon/dlt_daemon_common.c b/src/daemon/dlt_daemon_common.c
index 0eaff98..2e3cc75 100755
--- a/src/daemon/dlt_daemon_common.c
+++ b/src/daemon/dlt_daemon_common.c
@@ -1488,11 +1488,15 @@ void dlt_daemon_control_get_software_version(int sock, DltDaemon *daemon, int ve
     len = strlen(version);
 
     msg.datasize = sizeof(DltServiceGetSoftwareVersionResponse) + len;
-    if (msg.databuffer)
+    if (msg.databuffer && (msg.databuffersize < msg.datasize))
     {
         free(msg.databuffer);
+        msg.databuffer=0;
+    }
+    if (msg.databuffer == 0){
+    	msg.databuffer = (uint8_t *) malloc(msg.datasize);
+    	msg.databuffersize = msg.datasize;
     }
-    msg.databuffer = (uint8_t *) malloc(msg.datasize);
     if (msg.databuffer==0)
     {
         dlt_daemon_control_service_response(sock, daemon, DLT_SERVICE_ID_GET_SOFTWARE_VERSION, DLT_SERVICE_RESPONSE_ERROR,  verbose);
@@ -1532,11 +1536,15 @@ void dlt_daemon_control_get_default_log_level(int sock, DltDaemon *daemon, int v
     }
 
     msg.datasize = sizeof(DltServiceGetDefaultLogLevelResponse);
-    if (msg.databuffer)
+    if (msg.databuffer && (msg.databuffersize<msg.datasize))
     {
         free(msg.databuffer);
+        msg.databuffer=0;
+    }
+    if (msg.databuffer == 0){
+    	msg.databuffer = (uint8_t *) malloc(msg.datasize);
+    	msg.databuffersize = msg.datasize;
     }
-    msg.databuffer = (uint8_t *) malloc(msg.datasize);
     if (msg.databuffer==0)
     {
         dlt_daemon_control_service_response(sock, daemon, DLT_SERVICE_ID_GET_DEFAULT_LOG_LEVEL, DLT_SERVICE_RESPONSE_ERROR,  verbose);
@@ -1745,6 +1753,8 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltMessage *ms
 
     /* Allocate buffer for response message */
     resp.databuffer = (uint8_t *) malloc(resp.datasize);
+    resp.databuffersize = resp.datasize;
+
     if (resp.databuffer==0)
     {
         dlt_daemon_control_service_response(sock, daemon, DLT_SERVICE_ID_GET_LOG_INFO, DLT_SERVICE_RESPONSE_ERROR,  verbose);
@@ -1956,11 +1966,15 @@ void dlt_daemon_control_message_buffer_overflow(int sock, DltDaemon *daemon, int
 
     /* prepare payload of data */
     msg.datasize = sizeof(DltServiceMessageBufferOverflowResponse);
-    if (msg.databuffer)
+    if (msg.databuffer && (msg.databuffersize < msg.datasize))
     {
         free(msg.databuffer);
+        msg.databuffer=0;
+    }
+    if (msg.databuffer == 0){
+    	msg.databuffer = (uint8_t *) malloc(msg.datasize);
+    	msg.databuffersize = msg.datasize;
     }
-    msg.databuffer = (uint8_t *) malloc(msg.datasize);
     if (msg.databuffer==0)
     {
         if (sock!=DLT_DAEMON_STORE_TO_BUFFER)
@@ -2002,11 +2016,15 @@ void dlt_daemon_control_service_response( int sock, DltDaemon *daemon, uint32_t
 
     /* prepare payload of data */
     msg.datasize = sizeof(DltServiceResponse);
-    if (msg.databuffer)
+    if (msg.databuffer && (msg.databuffersize < msg.datasize))
     {
         free(msg.databuffer);
+        msg.databuffer=0;
+    }
+    if (msg.databuffer == 0){
+    	msg.databuffer = (uint8_t *) malloc(msg.datasize);
+    	msg.databuffersize = msg.datasize;
     }
-    msg.databuffer = (uint8_t *) malloc(msg.datasize);
     if (msg.databuffer==0)
     {
         return;
diff --git a/src/lib/dlt_client.c b/src/lib/dlt_client.c
index 39b5b07..b3962a7 100755
--- a/src/lib/dlt_client.c
+++ b/src/lib/dlt_client.c
@@ -327,11 +327,15 @@ int dlt_client_send_inject_msg(DltClient *client, char *apid, char *ctid, uint32
 
 	/* prepare payload of data */
 	msg.datasize = sizeof(uint32_t) + sizeof(uint32_t) + size;
-	if (msg.databuffer)
+	if (msg.databuffer && (msg.databuffersize < msg.datasize))
 	{
 		free(msg.databuffer);
+		msg.databuffer=0;
+	}
+	if (msg.databuffer == 0){
+		msg.databuffer = (uint8_t *) malloc(msg.datasize);
+		msg.databuffersize = msg.datasize;
 	}
-	msg.databuffer = (uint8_t *) malloc(msg.datasize);
 
 	memcpy(msg.databuffer  , &serviceID,sizeof(serviceID));
 	offset+=sizeof(uint32_t);
diff --git a/src/lib/dlt_user.c b/src/lib/dlt_user.c
index 3e8bf0e..b9ceb14 100755
--- a/src/lib/dlt_user.c
+++ b/src/lib/dlt_user.c
@@ -469,11 +469,14 @@ int dlt_register_app(const char *appid, const char * description)
 
     if (description!=0)
     {
-        dlt_user.application_description= malloc(strlen(description)+1);
-        strncpy(dlt_user.application_description, description, strlen(description));
+        size_t desc_len = strlen(description);
+        dlt_user.application_description= malloc(desc_len+1);
+        if (dlt_user.application_description){
+            strncpy(dlt_user.application_description, description, desc_len);
 
-        /* Terminate transmitted string with 0 */
-        dlt_user.application_description[strlen(description)]='\0';
+            /* Terminate transmitted string with 0 */
+            dlt_user.application_description[desc_len]='\0';
+        }
     }
 
     DLT_SEM_FREE();
@@ -667,7 +670,7 @@ int dlt_register_context_ll_ts(DltContext *handle, const char *contextid, const
 
         if (description!=0)
         {
-        	int desc_len = strlen(description);
+        	size_t desc_len = strlen(description);
             dlt_user.dlt_ll_ts[dlt_user.dlt_ll_ts_num_entries].context_description = malloc(desc_len+1);
             strncpy(dlt_user.dlt_ll_ts[dlt_user.dlt_ll_ts_num_entries].context_description, description, desc_len);