Changeset 2810

Show
Ignore:
Timestamp:
05/29/08 16:25:53 (7 months ago)
Author:
nashif
Message:

fixed possible buffer overflow by authenticated user

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • openwsman/branches/openwsman-1.5.x/src/server/shttpd.c

    r2079 r2810  
    837837 
    838838                        /* Allocate POST buffer */ 
    839                         if ((c->query = malloc(c->cclength + 1)) == NULL) { 
     839                        if ( c->cclength + 1 > c->cclength && (c->query = malloc(c->cclength + 1)) == NULL) { 
    840840                                senderr(c, 413, "Too Large", "", "huge POST"); 
    841841                                return; 

  • openwsman/branches/openwsman-1.5.x/src/server/wsmand-listener.c

    r2079 r2810  
    207207                error("NULL request body. len = %d", length); 
    208208        } 
    209 #if 0   
     209#if 0 
    210210        if(strcmp(wsman_msg->charset, "UTF-8")) { 
    211211                iconv_t cd = iconv_open("UTF-8", wsman_msg->charset); 
    …… 
    229229//              u_buf_construct(wsman_msg->request, mbbuf, length - outbuf_len, length - outbuf_len); 
    230230                debug("***coverted = %d***", length - outbuf_len); 
    231                  
    232         } 
    233 #endif          
     231 
     232        } 
     233#endif 
    234234        u_buf_construct(wsman_msg->request, body, length, length); 
    235235        debug("Posted request: %s, wsman_msg len = %d", u_buf_ptr(wsman_msg->request), 
    …… 
    320320        u_free(encoding); 
    321321        // add response body to output buffer 
    322       CONTINUE: 
     322CONTINUE: 
    323323        k = arg->buflen - n; 
    324324        if (k <= shttp_msg->length - shttp_msg->ind) { 
    …… 
    345345        u_free(shttp_msg->response); 
    346346        u_free(shttp_msg); 
    347          
     347 
    348348        arg->last = 1; 
    349349        arg->state = NULL; 
    …… 
    396396                goto DONE; 
    397397        } 
    398          
     398 
    399399        if(strncmp(shttpd_get_header(arg, "CIMExport"), "MethodRequest", strlen("MethodRequest")) || 
    400400                strncmp(shttpd_get_header(arg, "CIMExportMethod"), "ExportIndication", strlen("ExportIndication"))) { 
    …… 
    495495        n += snprintf(arg->buf + n, arg->buflen - n, "\r\n"); 
    496496        // add response body to output buffer 
    497       CONTINUE: 
     497CONTINUE: 
    498498        k = arg->buflen - n; 
    499499        if (k <= shttp_msg->length - shttp_msg->ind) { 
    …… 
    520520        u_free(shttp_msg->response); 
    521521        u_free(shttp_msg); 
    522          
     522 
    523523        arg->last = 1; 
    524524        arg->state = NULL;