cmdline: check size of result buffer to avoid overflow

[libcmdline.git] / src / lib / cmdline_parse_string.c

diff --git a/src/lib/cmdline_parse_string.c b/src/lib/cmdline_parse_string.c
index 7ac2892..1b9fdb8 100644 (file)
--- a/src/lib/cmdline_parse_string.c
+++ b/src/lib/cmdline_parse_string.c
@@ -1,3 +1,37 @@
+/*-
+ * Copyright (c) <2010>, Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * - Neither the name of Intel Corporation nor the names of its
+ *   contributors may be used to endorse or promote products derived
+ *   from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
 /*
  * Copyright (c) 2009, Olivier MATZ <zer0@droids-corp.org>
  * All rights reserved.
@@ -68,60 +102,55 @@ get_next_token(const char *s)
        return NULL;
 }
 
-int
-cmdline_parse_string(cmdline_parse_token_hdr_t *tk, const char *buf, void *res)
+static int parse_fixed_string(struct cmdline_token_string_data *sd,
+                             const char *buf, unsigned token_len)
 {
-       struct cmdline_token_string *tk2 = (struct cmdline_token_string *)tk;
-       struct cmdline_token_string_data *sd = &tk2->string_data;;
-       unsigned int token_len;
+       unsigned int conf_token_len;
        const char *str;
 
-       if (! *buf)
-               return -1;
+       str = sd->str;
+       for (str = sd->str; str != NULL ; str = get_next_token(str)) {
 
-       /* fixed string */
-       if (sd->str) {
-               str = sd->str;
-               do {
-                       token_len = get_token_len(str);
+               conf_token_len = get_token_len(str);
 
-                       /* if token is too big... */
-                       if (token_len >= STR_TOKEN_SIZE - 1) {
-                               continue;
-                       }
+               /* if token from config is too big... */
+               if (conf_token_len >= STR_TOKEN_SIZE - 1)
+                       continue;
 
-                       if ( strncmp(buf, str, token_len) ) {
-                               continue;
-                       }
+               /* compare conf token and user token */
+               if (token_len == conf_token_len &&
+                   strncmp(buf, str, token_len) == 0)
+                       return 0;
+       }
 
-                       if ( !cmdline_isendoftoken(*(buf+token_len)) ) {
-                               continue;
-                       }
+       return -1;
+}
 
-                       break;
-               } while ( (str = get_next_token(str)) != NULL );
+int
+cmdline_parse_string(cmdline_parse_token_hdr_t *tk, const char *buf, void *res,
+                    unsigned ressize)
+{
+       struct cmdline_token_string *tk2 = (struct cmdline_token_string *)tk;
+       struct cmdline_token_string_data *sd = &tk2->string_data;;
+       unsigned int token_len;
 
-               if (!str)
-                       return -1;
-       }
-       /* unspecified string */
-       else {
-               token_len=0;
-               while(!cmdline_isendoftoken(buf[token_len]) &&
-                     token_len < (STR_TOKEN_SIZE-1))
-                       token_len++;
+       if (res && ressize < STR_TOKEN_SIZE)
+               return -1;
+
+       token_len = strlen(buf);
+
+       if (token_len >= (STR_TOKEN_SIZE - 1) || token_len == 0)
+               return -1;
 
-               /* return if token too long */
-               if (token_len >= STR_TOKEN_SIZE - 1) {
+       /* fixed string */
+       if (sd->str) {
+               if (parse_fixed_string(sd, buf, token_len) < 0)
                        return -1;
-               }
        }
 
-       if (res) {
-               /* we are sure that token_len is < STR_TOKEN_SIZE-1 */
-               strncpy(res, buf, token_len);
-               *((char *)res + token_len) = 0;
-       }
+       /* we already checked that token_len is < STR_TOKEN_SIZE-1 */
+       if (res)
+               strcpy(res, buf);
 
        return token_len;
 }