fix memory overflow

plugins/restful/cert_handle.c

@@ -872,7 +872,9 @@ void handle_get_server_security_policy_resp(
     if (resp->policy_name != NULL && strlen(resp->policy_name) > 0) {
         // Split policy names by comma
         char *token = strtok(resp->policy_name, ",");
-        while (token != NULL) {
+        while (token != NULL &&
+               policy_count <
+                   (int) (sizeof(policy_names) / sizeof(policy_names[0]))) {
             policy_names[policy_count] = strdup(token);
             policy_count++;
             token = strtok(NULL, ",");

src/persist/persist.c

@@ -117,19 +117,23 @@ int read_file_string(const char *fn, char **out)
     }
 
     // read all file content
-    ssize_t n = 0;
-    while ((n = read(fd, buf + n, fsize))) {
-        if (fsize == n) {
-            break;
-        } else if (n < fsize && EINTR == errno) {
-            continue;
-        } else {
+    ssize_t total = 0;
+    while (total < fsize) {
+        ssize_t n = read(fd, buf + total, fsize - total);
+        if (n < 0) {
+            if (EINTR == errno) {
+                continue;
+            }
             rv = -1;
             goto error_read;
         }
+        if (0 == n) {
+            break; // EOF before the expected size
+        }
+        total += n;
     }
 
-    buf[fsize] = 0;
+    buf[total] = 0;
     *out       = buf;
     close(fd);
     return rv;

src/utils/base64.c

@@ -40,7 +40,7 @@ size_t calcDecodeLength(const char *b64input)
 { // Calculates the length of a decoded string
     size_t len = strlen(b64input), padding = 0;
 
-    if (0 == len) {
+    if (len < 4) {
         return 0;
     }
 
@@ -57,8 +57,11 @@ int Base64Decode(const char *b64message, unsigned char **buffer, int *length)
 { // Decodes a base64 encoded string
     BIO *bio, *b64;
 
-    int decodeLen        = calcDecodeLength(b64message);
-    *buffer              = (unsigned char *) malloc(decodeLen + 1);
+    int decodeLen = calcDecodeLength(b64message);
+    *buffer       = (unsigned char *) malloc(decodeLen + 1);
+    if (NULL == *buffer) {
+        return -1;
+    }
     (*buffer)[decodeLen] = '\0';
 
     bio = BIO_new_mem_buf(b64message, -1);

src/utils/cid.c

@@ -274,13 +274,17 @@ typedef struct {
 } da_basic_type_t;
 
 static int find_da_basic_type(cid_template_t *template, const char *datype_id,
-                              const char *seg_name, da_basic_type_t *da_types)
+                              const char *seg_name, da_basic_type_t *da_types,
+                              int max)
 {
     char name[NEU_CID_LEN64] = { 0 };
     int  index               = 0;
     for (int i = 0; i < template->n_datypes; i++) {
         if (strcmp(template->datypes[i].id, datype_id) == 0) {
             for (int j = 0; j < template->datypes[i].n_bdas; j++) {
+                if (index >= max) {
+                    break;
+                }
                 if (strlen(seg_name) > 0) {
                     snprintf(name, sizeof(name), "%s.%s", seg_name,
                              template->datypes[i].bdas[j].name);
@@ -291,7 +295,7 @@ static int find_da_basic_type(cid_template_t *template, const char *datype_id,
                 if (template->datypes[i].bdas[j].btype == Struct) {
                     index += find_da_basic_type(
                         template, template->datypes[i].bdas[j].ref_type, name,
-                        da_types + index);
+                        da_types + index, max - index);
                 } else {
                     snprintf(da_types[index].all_name,
                              sizeof(da_types[index].all_name), "%s", name);
@@ -336,8 +340,9 @@ static int find_basic_type(cid_template_t *template, const char *type_id,
         *array_size = dotype->das[i].array_size;
 
         da_basic_type_t da_types[32] = { 0 };
-        int n_da_types = find_da_basic_type(template, dotype->das[i].ref_type,
-                                            dotype->das[i].name, da_types);
+        int             n_da_types   = find_da_basic_type(
+            template, dotype->das[i].ref_type, dotype->das[i].name, da_types,
+            (int) (sizeof(da_types) / sizeof(da_types[0])));
         for (int j = 0; j < n_da_types; j++) {
             if (strlen(da_name) > 0) {
                 if (strcmp(da_types[j].all_name, da_name) == 0) {
@@ -465,7 +470,8 @@ static void update_doi(const char *ref_type, cid_doi_t *dois, int n_dois,
 
             da_basic_type_t da_types[32] = { 0 };
             int             n_da_types   = find_da_basic_type(
-                template, tm_do->das[k].ref_type, tm_do->das[k].name, da_types);
+                template, tm_do->das[k].ref_type, tm_do->das[k].name, da_types,
+                (int) (sizeof(da_types) / sizeof(da_types[0])));
 
             if (da->fc == SP || da->fc == SG) {
                 for (int j = 0; j < n_da_types; j++) {
@@ -492,8 +498,13 @@ static void update_doi(const char *ref_type, cid_doi_t *dois, int n_dois,
                 ctl->btype = da_types[0].btype;
                 ctl->fc    = da->fc;
                 snprintf(ctl->da_name, sizeof(ctl->da_name), "%s", da->name);
-                ctl->n_co_types = n_da_types;
-                for (int j = 0; j < n_da_types; j++) {
+                int n_co = n_da_types;
+                if (n_co >
+                    (int) (sizeof(ctl->co_types) / sizeof(ctl->co_types[0]))) {
+                    n_co = sizeof(ctl->co_types) / sizeof(ctl->co_types[0]);
+                }
+                ctl->n_co_types = n_co;
+                for (int j = 0; j < n_co; j++) {
                     ctl->co_types[j] = da_types[j].btype;
                 }
             }