packages/lcr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
lcr/0007-Fix-empty-pointer-and-overflow.patch
jikai 3b4b08f18a sync from upstream 
Signed-off-by: jikai <jikai11@huawei.com>
(cherry picked from commit 0a5748543c47e895a44afbc57de2d1ad6f9063d9)
2024-06-11 19:20:37 +08:00

1002 lines
33 KiB
Diff
Raw Permalink Blame History

From 2df5066a9741e9534d13bc422dad69bb6a2c12ce Mon Sep 17 00:00:00 2001
From: jikai <jikai11@huawei.com>
Date: Mon, 28 Aug 2023 12:59:08 +0000
Subject: [PATCH 07/22] Fix empty pointer and overflow
Signed-off-by: jikai <jikai11@huawei.com>
---
src/buffer.c | 4 +
src/conf.c | 63 +++++++++++--
src/lcrcontainer.c | 135 ++-------------------------
src/lcrcontainer.h | 40 --------
src/lcrcontainer_execute.c | 30 ++++++
src/lcrcontainer_extend.c | 144 ++++-------------------------
src/lcrcontainer_extend.h | 11 ---
src/utils.c | 5 +
tests/fuzz/log_fuzz.cc | 2 +-
third_party/go_crc64.c | 6 +-
third_party/libocispec/common_c.py | 58 +++++++++---
third_party/libocispec/common_h.py | 4 +
third_party/libocispec/sources.py | 26 ++++--
13 files changed, 192 insertions(+), 336 deletions(-)
diff --git a/src/buffer.c b/src/buffer.c
index 39e0360..fb9e153 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -158,6 +158,10 @@ static int buffer_append(Buffer *buf, const char *append, size_t length)
return -1;
}
+ if (length == SIZE_MAX) {
+ return -1;
+ }
+
desired_length = length + 1;
if (!buffer_has_space(buf, desired_length)) {
if (buffer_grow(buf, desired_length) != 0) {
diff --git a/src/conf.c b/src/conf.c
index 2b02887..10214f0 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -638,6 +638,10 @@ static int trans_oci_process_prlimit(const defs_process *proc, struct lcr_list *
for (i = 0; i < proc->rlimits_len; i++) {
defs_process_rlimits_element *lr = proc->rlimits[i];
+ if (lr == NULL) {
+ continue;
+ }
+
char buf_key[30] = { 0 };
char buf_value[60] = { 0 };
size_t j;
@@ -750,6 +754,10 @@ struct lcr_list *trans_oci_process(const defs_process *proc)
{
struct lcr_list *conf = NULL;
+ if (proc == NULL) {
+ return NULL;
+ }
+
conf = lcr_util_common_calloc_s(sizeof(struct lcr_list));
if (conf == NULL) {
return NULL;
@@ -1093,7 +1101,8 @@ bool is_system_container(const oci_runtime_spec *container)
{
size_t i = 0;
for (i = 0; container->annotations != NULL && i < container->annotations->len; i++) {
- if (strcmp(container->annotations->keys[i], "system.container") == 0) {
+ if (container->annotations->keys[i] != NULL &&
+ strcmp(container->annotations->keys[i], "system.container") == 0) {
return true;
}
}
@@ -1104,7 +1113,8 @@ static bool is_external_rootfs(const oci_runtime_spec *container)
{
size_t i = 0;
for (i = 0; container->annotations != NULL && i < container->annotations->len; i++) {
- if (strcmp(container->annotations->keys[i], "external.rootfs") == 0) {
+ if (container->annotations->keys[i] != NULL &&
+ strcmp(container->annotations->keys[i], "external.rootfs") == 0) {
return true;
}
}
@@ -1166,8 +1176,14 @@ struct lcr_list *trans_oci_mounts(const oci_runtime_spec *c)
struct lcr_list *node = NULL;
defs_mount *tmp = NULL;
size_t i;
- bool system_container = is_system_container(c);
- bool external_rootfs = is_external_rootfs(c);
+ bool system_container = false;
+ bool external_rootfs = false;
+
+ if (c == NULL) {
+ return NULL;
+ }
+ system_container = is_system_container(c);
+ external_rootfs = is_external_rootfs(c);
conf = lcr_util_common_calloc_s(sizeof(*conf));
if (conf == NULL) {
@@ -1177,7 +1193,7 @@ struct lcr_list *trans_oci_mounts(const oci_runtime_spec *c)
for (i = 0; i < c->mounts_len; i++) {
tmp = c->mounts[i];
- if (tmp->type == NULL) {
+ if (tmp == NULL || tmp->type == NULL) {
goto out_free;
}
@@ -1206,6 +1222,10 @@ static int trans_one_oci_id_mapping(struct lcr_list *conf, const char *typ, cons
char buf_value[DEFAULT_BUF_LEN] = { 0 };
char subid[ID_MAP_LEN] = { 0 };
+ if (id == NULL) {
+ return -1;
+ }
+
nret = snprintf(buf_value, sizeof(buf_value), "%s %u %u %u", typ, id->container_id, id->host_id, id->size);
if (nret < 0 || (size_t)nret >= sizeof(buf_value)) {
return -1;
@@ -1570,6 +1590,10 @@ static int trans_resources_devices_v1(const defs_resources *res, struct lcr_list
for (i = 0; i < res->devices_len; i++) {
defs_device_cgroup *lrd = res->devices[i];
+ if (lrd == NULL) {
+ continue;
+ }
+
if (trans_resources_devices_ret(lrd, buf_value, sizeof(buf_value)) < 0) {
goto out;
}
@@ -2006,6 +2030,10 @@ static int trans_resources_devices_v2(const defs_resources *res, struct lcr_list
for (i = 0; i < res->devices_len; i++) {
defs_device_cgroup *lrd = res->devices[i];
+ if (lrd == NULL) {
+ continue;
+ }
+
if (trans_resources_devices_ret(lrd, buf_value, sizeof(buf_value)) < 0) {
goto out;
}
@@ -2492,7 +2520,7 @@ static struct lcr_list *trans_oci_namespaces(const oci_runtime_config_linux *l)
char *ns_name = NULL;
ns = l->namespaces[i];
- if (ns->type == NULL || ns->path == NULL) {
+ if (ns == NULL || ns->type == NULL || ns->path == NULL) {
continue;
}
@@ -2807,6 +2835,12 @@ static int seccomp_append_rule(const defs_syscall *syscall, size_t i, Buffer *bu
ret = -1;
goto out;
}
+
+ if (strlen(syscall->names[i]) > SIZE_MAX - strlen(action) - 2) {
+ ERROR("Out of range");
+ ret = -1;
+ goto out;
+ }
if (buffer_nappendf(buffer, strlen(syscall->names[i]) + strlen(action) + 2, "%s %s", syscall->names[i], action)) {
ERROR("Failed to append syscall name and action\n");
ret = -1;
@@ -2819,6 +2853,15 @@ static int seccomp_append_rule(const defs_syscall *syscall, size_t i, Buffer *bu
ret = -1;
goto out;
}
+
+ /* Appending content is syscall->args[j]->op plus
+ * three unsigned numbers(which length is no more than 20 * 3)
+ */
+ if (strlen(syscall->args[j]->op) > SIZE_MAX - 20 * 3) {
+ ERROR("Out of range");
+ ret = -1;
+ goto out;
+ }
if (buffer_nappendf(buffer, 20 * 3 + strlen(syscall->args[j]->op), " [%u,%llu,%s,%llu]",
syscall->args[j]->index, syscall->args[j]->value, syscall->args[j]->op,
syscall->args[j]->value_two)) {
@@ -3032,6 +3075,10 @@ struct lcr_list *trans_oci_linux(const oci_runtime_config_linux *l, char **secco
int ret = 0;
struct lcr_list *tmp = NULL;
+ if (l == NULL) {
+ return NULL;
+ }
+
struct lcr_list *conf = lcr_util_common_calloc_s(sizeof(*conf));
if (conf == NULL) {
return NULL;
@@ -3114,6 +3161,10 @@ struct lcr_list *trans_annotations(const json_map_string_string *anno)
size_t len;
int ret = 0;
+ if (anno == NULL) {
+ return NULL;
+ }
+
struct lcr_list *conf = lcr_util_common_calloc_s(sizeof(*conf));
if (conf == NULL) {
return NULL;
diff --git a/src/lcrcontainer.c b/src/lcrcontainer.c
index ca587e4..f65f570 100644
--- a/src/lcrcontainer.c
+++ b/src/lcrcontainer.c
@@ -44,52 +44,6 @@
#include "utils.h"
#include "oci_runtime_spec.h"
-/*
- * Free lcr_container_info array returned by lcr_list_{active,all}_containers
- */
-void lcr_containers_info_free(struct lcr_container_info **info_arr, size_t size)
-{
- size_t i = 0;
- struct lcr_container_info *in = NULL;
-
- if (info_arr == NULL) {
- return;
- }
- if (size == 0) {
- return;
- }
- for (i = 0, in = *info_arr; i < size; i++, in++) {
- free(in->interface);
- free(in->ipv4);
- free(in->ipv6);
- free(in->name);
- free(in->state);
- }
- free(*info_arr);
- *info_arr = NULL;
-}
-
-/*
- * Free lcr_container_info returned lcr_container_info_get
- */
-void lcr_container_info_free(struct lcr_container_info *info)
-{
- if (info == NULL) {
- return;
- }
- free(info->interface);
- info->interface = NULL;
- free(info->ipv4);
- info->ipv4 = NULL;
- free(info->ipv6);
- info->ipv6 = NULL;
- free(info->name);
- info->name = NULL;
- free(info->state);
- info->state = NULL;
- free(info);
-}
-
static inline bool is_container_exists(struct lxc_container *c)
{
return c->is_defined(c);
@@ -100,85 +54,6 @@ static inline bool is_container_can_control(struct lxc_container *c)
return c->may_control(c);
}
-/*
- * Get one container info for a given name and lcrpath.
- * return struct of container info, or NULL on error.
- */
-struct lcr_container_info *lcr_container_info_get(const char *name, const char *lcrpath)
-{
- int nret = -1;
- struct lcr_container_info *info = NULL;
- const char *st = NULL;
- bool run_flag = false;
-
- struct lxc_container *c = lxc_container_without_config_new(name, lcrpath);
- if (c == NULL) {
- return NULL;
- }
-
- if (!is_container_exists(c)) {
- goto put_and_finish;
- }
-
- st = c->state(c);
- if (st == NULL) {
- st = "UNKNOWN";
- }
- run_flag = (strcmp(st, "STOPPED") != 0);
-
- /* Now it makes sense to allocate memory */
- info = lcr_util_common_calloc_s(sizeof(*info));
- if (info == NULL) {
- nret = -1;
- goto put_and_finish;
- }
- info->init = -1;
- info->running = run_flag;
- info->name = lcr_util_strdup_s(name);
- info->state = lcr_util_strdup_s(st);
- if (run_flag) {
- info->init = c->init_pid(c);
- }
-
- nret = 0;
-put_and_finish:
- lxc_container_put(c);
- if (nret != 0) {
- lcr_container_info_free(info);
- info = NULL;
- }
- return info;
-}
-
-/*
- * Get a complete list of all containers for a given lcrpath.
- * return Number of containers, or -1 on error.
- **/
-int lcr_list_all_containers(const char *lcrpath, struct lcr_container_info **info_arr)
-{
- char **container = NULL;
- int n = 0;
- int nret = -1;
- size_t info_size = 0;
- const char *path = lcrpath ? lcrpath : LCRPATH;
-
- clear_error_message(&g_lcr_error);
- n = list_all_containers(path, &container, NULL);
- if (n == -1) {
- n = 0;
- }
-
- nret = lcr_containers_info_get(path, info_arr, &info_size, container, n);
- if (info_arr == NULL && nret == 0) {
- return -1;
- } else if (info_arr == NULL || nret == -1) {
- lcr_containers_info_free(info_arr, info_size);
- return -1;
- }
-
- return (int)info_size;
-}
-
static int create_partial(const struct lxc_container *c)
{
int fd = 0;
@@ -276,6 +151,16 @@ bool lcr_create(const char *name, const char *lcrpath, void *oci_config)
const char *tmp_path = lcrpath ? lcrpath : LCRPATH;
oci_runtime_spec *oci_spec = (oci_runtime_spec *)oci_config;
+ if (name == NULL) {
+ ERROR("Missing container name");
+ return false;
+ }
+
+ if (oci_spec == NULL) {
+ ERROR("Empty oci config");
+ return false;
+ }
+
clear_error_message(&g_lcr_error);
isula_libutils_set_log_prefix(name);
diff --git a/src/lcrcontainer.h b/src/lcrcontainer.h
index 5cb3647..b065641 100644
--- a/src/lcrcontainer.h
+++ b/src/lcrcontainer.h
@@ -46,24 +46,6 @@ struct lcr_console_config {
char *log_file_size;
};
-/*
-* Store lcr container info
-*/
-struct lcr_container_info {
- /* Name of container. */
- char *name;
- /* State of container. */
- char *state;
- /* Interface of container. */
- char *interface;
- char *ipv4;
- char *ipv6;
- pid_t init;
- double ram;
- double swap;
- bool running;
-};
-
struct blkio_stats {
uint64_t read;
uint64_t write;
@@ -129,28 +111,6 @@ struct lcr_cgroup_resources {
int64_t cpurt_runtime;
};
-/*
-* Get one container info for a given lcrpath.
-* return struct of container info, or NULL on error.
-*/
-struct lcr_container_info *lcr_container_info_get(const char *name, const char *lcrpath);
-
-/*
-* Free lcr_container_info returned lcr_container_info_get
-*/
-void lcr_container_info_free(struct lcr_container_info *info);
-
-/*
-* Get a complete list of all containers for a given lcrpath.
-* return Number of containers, or -1 on error.
-*/
-int lcr_list_all_containers(const char *lcrpath, struct lcr_container_info **info_arr);
-
-/*
-* Free lcr_container_info array returned by lcr_list_{active,all}_containers
-*/
-void lcr_containers_info_free(struct lcr_container_info **info_arr, size_t size);
-
/*
* Create a container
* param name : container name
diff --git a/src/lcrcontainer_execute.c b/src/lcrcontainer_execute.c
index 4c49a28..b924254 100644
--- a/src/lcrcontainer_execute.c
+++ b/src/lcrcontainer_execute.c
@@ -749,6 +749,11 @@ bool do_update(struct lxc_container *c, const char *name, const char *lcrpath, s
{
bool bret = false;
+ if (c == NULL) {
+ ERROR("Invalid arg c");
+ return bret;
+ }
+
// If container is not running, update config file is enough,
// resources will be updated when the container is started again.
// If container is running (including paused), we need to update configs
@@ -773,6 +778,16 @@ void do_lcr_state(struct lxc_container *c, struct lcr_container_state *lcs)
{
struct lxc_container_metrics lxc_metrics = { 0 };
+ if (c == NULL) {
+ ERROR("Invalid argument c");
+ return;
+ }
+
+ if (lcs == NULL) {
+ ERROR("Invalid argument lcs");
+ return;
+ }
+
clear_error_message(&g_lcr_error);
(void)memset(lcs, 0x00, sizeof(struct lcr_container_state));
@@ -925,6 +940,16 @@ bool do_attach(const char *name, const char *path, const struct lcr_exec_request
int pipefd[2] = {-1, -1};
int status = 0;
+ if (request == NULL) {
+ ERROR("Invalid request");
+ return false;
+ }
+
+ if (exit_code == NULL) {
+ ERROR("Invalid exit code");
+ return false;
+ }
+
if (pipe(pipefd) != 0) {
ERROR("Failed to create pipe\n");
return false;
@@ -988,6 +1013,11 @@ void execute_lxc_start(const char *name, const char *path, const struct lcr_star
size_t i = 0;
int nret = 0;
+ if (request == NULL) {
+ COMMAND_ERROR("Invalid request");
+ exit(EXIT_FAILURE);
+ }
+
if (lcr_util_check_inherited(true, -1) != 0) {
COMMAND_ERROR("Close inherited fds failed");
}
diff --git a/src/lcrcontainer_extend.c b/src/lcrcontainer_extend.c
index e03c212..645f159 100644
--- a/src/lcrcontainer_extend.c
+++ b/src/lcrcontainer_extend.c
@@ -422,74 +422,6 @@ cleanup:
return NULL;
}
-static struct lcr_container_info *info_new(struct lcr_container_info **info, size_t *size)
-{
- struct lcr_container_info *m = NULL;
- struct lcr_container_info *n = NULL;
- size_t length = 0;
- int nret = 0;
-
- if (*size > SIZE_MAX / sizeof(struct lcr_container_info) - 1) {
- return NULL;
- }
-
- length = (*size + 1) * sizeof(struct lcr_container_info);
-
- nret = lcr_mem_realloc((void **)&n, length, (void *)(*info), (*size) * sizeof(struct lcr_container_info));
- if (nret < 0) {
- return NULL;
- }
-
- *info = n;
- m = *info + *size;
- (*size)++;
-
- // *INDENT-OFF*
- *m = (struct lcr_container_info) {
- .name = NULL, .state = NULL, .interface = NULL, .ipv4 = NULL, .ipv6 = NULL, .ram = 0.0, .swap = 0.0, .init = -1
- };
- // *INDENT-ON*
- return m;
-}
-
-static void free_arr(char **array, size_t size)
-{
- size_t i;
- for (i = 0; i < size; i++) {
- free(array[i]);
- array[i] = NULL;
- }
- free(array);
-}
-
-/*
- * Get a complete list of active containers for a given lcrpath.
- * return Number of containers, or -1 on error.
- **/
-int lcr_list_active_containers(const char *lcrpath, struct lcr_container_info **info_arr)
-{
- char **c = NULL;
- int n = 0;
- int nret = -1;
- size_t info_size = 0;
- const char *path = lcrpath ? lcrpath : LCRPATH;
-
- n = list_active_containers(path, &c, NULL);
- if (n == -1) {
- n = 0;
- }
-
- nret = lcr_containers_info_get(path, info_arr, &info_size, c, n);
- if ((info_arr == NULL) && nret == 0) {
- return -1;
- } else if ((info_arr == NULL) || nret == -1) {
- lcr_containers_info_free(info_arr, info_size);
- return -1;
- }
-
- return (int)info_size;
-}
-
bool lcr_delete_with_force(const char *name, const char *lcrpath, bool force)
{
struct lxc_container *c = NULL;
@@ -560,61 +492,6 @@ void lcr_free_config(struct lcr_list *lcr_conf)
}
}
-int lcr_containers_info_get(const char *lcrpath, struct lcr_container_info **info, size_t *size, char **containers,
- int num)
-{
- struct lcr_container_info *in = NULL;
- struct lxc_container *c = NULL;
- int i;
- int nret = -1;
-
- if ((lcrpath == NULL) || num == 0) {
- goto err_out;
- }
-
- for (i = 0; i < num; i++) {
- const char *st = NULL;
- const char *name = containers[i];
- bool run_flag = true;
- if (name == NULL) {
- continue;
- }
-
- c = lxc_container_without_config_new(name, lcrpath);
- if (c == NULL) {
- continue;
- }
-
- if (!c->is_defined(c)) {
- goto put_container;
- }
-
- st = c->state(c);
- if (st == NULL) {
- st = "UNKNOWN";
- }
- run_flag = (strcmp(st, "STOPPED") != 0);
-
- /* Now it makes sense to allocate memory */
- in = info_new(info, size);
- if (in == NULL) {
- goto put_container;
- }
- in->running = run_flag;
- in->name = lcr_util_strdup_s(name);
- in->state = lcr_util_strdup_s(st);
- if (run_flag) {
- in->init = c->init_pid(c);
- }
-put_container:
- lxc_container_put(c);
- }
- nret = 0;
-err_out:
- free_arr(containers, (size_t)num);
- return nret;
-}
-
/*
* Transform container JSON into oci_runtime_spec struct
*/
@@ -624,6 +501,11 @@ bool container_parse(const char *oci_filename, const char *oci_json_data, oci_ru
parser_error err = NULL;
bool ret = true;
+ if (container == NULL) {
+ ERROR("Invalid container arg");
+ return false;
+ }
+
if (oci_json_data == NULL) {
*container = oci_runtime_spec_parse_file(oci_filename, &ctx, &err);
} else {
@@ -680,6 +562,11 @@ struct lcr_list *lcr_oci2lcr(const struct lxc_container *c, oci_runtime_spec *co
{
struct lcr_list *lcr_conf = NULL;
+ if (container == NULL) {
+ ERROR("Invalid arguments");
+ return NULL;
+ }
+
lcr_conf = lcr_util_common_calloc_s(sizeof(*lcr_conf));
if (lcr_conf == NULL) {
goto out_free;
@@ -765,6 +652,10 @@ static char *escape_string_encode(const char *src)
return NULL;
}
+ if (len > (SIZE_MAX - 1) / 2) {
+ return NULL;
+ }
+
dst = lcr_util_common_calloc_s(2 * len + 1);
if (dst == NULL) {
ERROR("Out of memory");
@@ -863,7 +754,7 @@ cleanup:
return ret;
}
-char *lcr_get_bundle(const char *lcrpath, const char *name)
+static char *lcr_get_bundle(const char *lcrpath, const char *name)
{
size_t len = 0;
int nret = 0;
@@ -921,6 +812,11 @@ bool lcr_save_spec(const char *name, const char *lcrpath, const struct lcr_list
return bret;
}
+ if (lcr_conf == NULL) {
+ ERROR("Empty lcr conf");
+ return bret;
+ }
+
bundle = lcr_get_bundle(path, name);
if (bundle == NULL) {
goto out_free;
diff --git a/src/lcrcontainer_extend.h b/src/lcrcontainer_extend.h
index 981a2bb..f524a4a 100644
--- a/src/lcrcontainer_extend.h
+++ b/src/lcrcontainer_extend.h
@@ -44,12 +44,6 @@ struct lcr_list;
} \
} while (0);
-/*
- * Get a complete list of active containers for a given lcrpath.
- * return Number of containers, or -1 on error.
- */
-int lcr_list_active_containers(const char *lcrpath, struct lcr_container_info **info_arr);
-
/*
* Delete a container
* param name : container name, required.
@@ -82,11 +76,6 @@ struct lcr_list *lcr_oci2lcr(const struct lxc_container *c, oci_runtime_spec *co
*/
bool lcr_save_spec(const char *name, const char *lcrpath, const struct lcr_list *lcr_conf, const char *seccomp_conf);
-int lcr_containers_info_get(const char *lcrpath, struct lcr_container_info **info, size_t *size, char **containers,
- int num);
-
-char *lcr_get_bundle(const char *lcrpath, const char *name);
-
bool translate_spec(const struct lxc_container *c, oci_runtime_spec *container);
#ifdef __cplusplus
diff --git a/src/utils.c b/src/utils.c
index 4b123bb..d1271dd 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -1287,6 +1287,11 @@ out:
/* swap in oci is memoy+swap, so here we need to get real swap */
int lcr_util_get_real_swap(int64_t memory, int64_t memory_swap, int64_t *swap)
{
+ if (swap == NULL) {
+ ERROR("empty swap pointer");
+ return -1;
+ }
+
if (memory == -1 && memory_swap == 0) {
*swap = -1; // -1 is max
return 0;
diff --git a/tests/fuzz/log_fuzz.cc b/tests/fuzz/log_fuzz.cc
index a8f80d4..4128ff6 100644
--- a/tests/fuzz/log_fuzz.cc
+++ b/tests/fuzz/log_fuzz.cc
@@ -40,7 +40,6 @@ extern "C" void testLog(struct isula_libutils_log_config *conf)
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
- const char *default_name = "iSula";
struct isula_libutils_log_config tconf = {0};
std::string testData(reinterpret_cast<const char *>(data), size);
std::vector<std::string> ret_vec;
@@ -67,6 +66,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
tconf.driver = ret_vec[4].c_str();
}
} else {
+ const char *default_name = "iSula";
isula_libutils_default_log_config(default_name, &tconf);
}
diff --git a/third_party/go_crc64.c b/third_party/go_crc64.c
index 44d0a75..c78ac85 100644
--- a/third_party/go_crc64.c
+++ b/third_party/go_crc64.c
@@ -32,10 +32,9 @@ isula_crc_table_t g_iso_crc_table;
static void make_table(isula_crc_table_t *tab, uint64_t poly)
{
uint64_t i, j;
- uint64_t t;
for (i = 0; i < CRC_COL_LEN; i++) {
- t = i;
+ uint64_t t = i;
for (j = 0; j < CRC_ROW_LEN; j++) {
if ((t & 1) == 1) {
t = (t >> 1) ^ poly;
@@ -50,10 +49,9 @@ static void make_table(isula_crc_table_t *tab, uint64_t poly)
static void make_crc_table(isula_crc_table_t *tab)
{
uint64_t i, j;
- uint64_t crc;
for (i = 0; i < CRC_COL_LEN; i++) {
- crc = tab->table[0][i];
+ uint64_t crc = tab->table[0][i];
for (j = 1; j < CRC_ROW_LEN; j++) {
crc = tab->table[0][(crc&0xff)] ^ (crc >> 8);
tab->table[j][i] = crc;
diff --git a/third_party/libocispec/common_c.py b/third_party/libocispec/common_c.py
index 968d5d2..1207b72 100644
--- a/third_party/libocispec/common_c.py
+++ b/third_party/libocispec/common_c.py
@@ -42,6 +42,13 @@ CODE = '''// Auto generated file. Do not edit!
# define MAX_NUM_STR_LEN 21
+#if __WORDSIZE == 64
+// current max user memory for 64-machine is 2^47 B
+#define MAX_MEMORY_SIZE ((size_t)1 << 47)
+#else
+// current max user memory for 32-machine is 2^31 B
+#define MAX_MEMORY_SIZE ((size_t)1 << 31)
+#endif
static yajl_gen_status gen_yajl_val (yajl_val obj, yajl_gen g, parser_error *err);
@@ -205,6 +212,27 @@ void *safe_malloc(size_t size) {
return ret;
}
+void *smart_safe_malloc(size_t count, size_t extra, size_t unit_size) {
+ void *ret = NULL;
+ if (unit_size == 0) {
+ abort();
+ }
+
+ if (extra > MAX_MEMORY_SIZE || count > MAX_MEMORY_SIZE - extra) {
+ abort();
+ }
+
+ if (count + extra == 0 || count + extra > (MAX_MEMORY_SIZE / unit_size)) {
+ abort();
+ }
+
+ ret = calloc(count + extra, unit_size);
+ if (ret == NULL) {
+ abort();
+ }
+ return ret;
+}
+
int common_safe_double(const char *numstr, double *converted) {
char *err_str = NULL;
double d;
@@ -557,8 +585,8 @@ json_map_int_int *make_json_map_int_int(yajl_val src, const struct parser_contex
size_t len = YAJL_GET_OBJECT(src)->len;
ret = safe_malloc(sizeof(*ret));
ret->len = len;
- ret->keys = safe_malloc((len + 1) * sizeof(int));
- ret->values = safe_malloc((len + 1) * sizeof(int));
+ ret->keys = smart_safe_malloc(len, 1, sizeof(int));
+ ret->values = smart_safe_malloc(len, 1, sizeof(int));
for (i = 0; i < len; i++) {
const char *srckey = YAJL_GET_OBJECT(src)->keys[i];
yajl_val srcval = YAJL_GET_OBJECT(src)->values[i];
@@ -695,8 +723,8 @@ json_map_int_bool *make_json_map_int_bool(yajl_val src, const struct parser_cont
size_t len = YAJL_GET_OBJECT(src)->len;
ret = safe_malloc(sizeof(*ret));
ret->len = len;
- ret->keys = safe_malloc((len + 1) * sizeof(int));
- ret->values = safe_malloc((len + 1) * sizeof(bool));
+ ret->keys = smart_safe_malloc(len, 1, sizeof(int));
+ ret->values = smart_safe_malloc(len, 1, sizeof(bool));
for (i = 0; i < len; i++) {
const char *srckey = YAJL_GET_OBJECT(src)->keys[i];
yajl_val srcval = YAJL_GET_OBJECT(src)->values[i];
@@ -829,8 +857,8 @@ json_map_int_string *make_json_map_int_string(yajl_val src, const struct parser_
size_t len = YAJL_GET_OBJECT(src)->len;
ret = safe_malloc(sizeof(*ret));
ret->len = len;
- ret->keys = safe_malloc((len + 1) * sizeof(int));
- ret->values = safe_malloc((len + 1) * sizeof(char *));
+ ret->keys = smart_safe_malloc(len, 1, sizeof(int));
+ ret->values = smart_safe_malloc(len, 1, sizeof(char *));
for (i = 0; i < len; i++) {
const char *srckey = YAJL_GET_OBJECT(src)->keys[i];
yajl_val srcval = YAJL_GET_OBJECT(src)->values[i];
@@ -951,8 +979,8 @@ json_map_string_int *make_json_map_string_int(yajl_val src, const struct parser_
size_t len = YAJL_GET_OBJECT(src)->len;
ret = safe_malloc(sizeof(*ret));
ret->len = len;
- ret->keys = safe_malloc((len + 1) * sizeof(char *));
- ret->values = safe_malloc((len + 1) * sizeof(int));
+ ret->keys = smart_safe_malloc(len, 1, sizeof(char *));
+ ret->values = smart_safe_malloc(len, 1, sizeof(int));
for (i = 0; i < len; i++) {
const char *srckey = YAJL_GET_OBJECT(src)->keys[i];
yajl_val srcval = YAJL_GET_OBJECT(src)->values[i];
@@ -1069,8 +1097,8 @@ json_map_string_int64 *make_json_map_string_int64(yajl_val src, const struct par
size_t len = YAJL_GET_OBJECT(src)->len;
ret = safe_malloc(sizeof(*ret));
ret->len = len;
- ret->keys = safe_malloc((len + 1) * sizeof(char *));
- ret->values = safe_malloc((len + 1) * sizeof(int64_t));
+ ret->keys = smart_safe_malloc(len, 1, sizeof(char *));
+ ret->values = smart_safe_malloc(len, 1, sizeof(int64_t));
for (i = 0; i < len; i++) {
const char *srckey = YAJL_GET_OBJECT(src)->keys[i];
yajl_val srcval = YAJL_GET_OBJECT(src)->values[i];
@@ -1188,8 +1216,8 @@ json_map_string_bool *make_json_map_string_bool(yajl_val src, const struct parse
size_t len = YAJL_GET_OBJECT(src)->len;
ret = safe_malloc(sizeof(*ret));
ret->len = len;
- ret->keys = safe_malloc((len + 1) * sizeof(char *));
- ret->values = safe_malloc((len + 1) * sizeof(bool));
+ ret->keys = smart_safe_malloc(len, 1, sizeof(char *));
+ ret->values = smart_safe_malloc(len, 1, sizeof(bool));
for (i = 0; i < len; i++) {
const char *srckey = YAJL_GET_OBJECT(src)->keys[i];
yajl_val srcval = YAJL_GET_OBJECT(src)->values[i];
@@ -1303,8 +1331,8 @@ json_map_string_string *make_json_map_string_string(yajl_val src, const struct p
size_t len = YAJL_GET_OBJECT(src)->len;
ret = safe_malloc(sizeof(*ret));
ret->len = len;
- ret->keys = safe_malloc((len + 1) * sizeof(char *));
- ret->values = safe_malloc((len + 1) * sizeof(char *));
+ ret->keys = smart_safe_malloc(len, 1, sizeof(char *));
+ ret->values = smart_safe_malloc(len, 1, sizeof(char *));
for (i = 0; i < len; i++) {
const char *srckey = YAJL_GET_OBJECT(src)->keys[i];
yajl_val srcval = YAJL_GET_OBJECT(src)->values[i];
@@ -1442,7 +1470,7 @@ char *json_marshal_string(const char *str, size_t strlen, const struct parser_co
goto free_out;
}
- json_buf = safe_malloc(gen_len + 1);
+ json_buf = smart_safe_malloc(gen_len, 1, 1);
(void)memcpy(json_buf, gen_buf, gen_len);
json_buf[gen_len] = '\\0';
diff --git a/third_party/libocispec/common_h.py b/third_party/libocispec/common_h.py
index 02c689d..a5d3047 100644
--- a/third_party/libocispec/common_h.py
+++ b/third_party/libocispec/common_h.py
@@ -89,6 +89,8 @@ extern "C" {
return stat; \\
}
+#define JSON_MAX_SIZE (10LL * 1024LL * 1024LL)
+
typedef char *parser_error;
struct parser_context {
@@ -108,6 +110,8 @@ yajl_val get_val(yajl_val tree, const char *name, yajl_type type);
void *safe_malloc(size_t size);
+void *smart_safe_malloc(size_t count, size_t extra, size_t unit_size);
+
int common_safe_double(const char *numstr, double *converted);
int common_safe_uint8(const char *numstr, uint8_t *converted);
diff --git a/third_party/libocispec/sources.py b/third_party/libocispec/sources.py
index 88f83d5..56b594b 100644
--- a/third_party/libocispec/sources.py
+++ b/third_party/libocispec/sources.py
@@ -59,10 +59,10 @@ def parse_map_string_obj(obj, c_file, prefix, obj_typename):
c_file.write(' if (YAJL_GET_OBJECT(tree) != NULL && YAJL_GET_OBJECT(tree)->len > 0) {\n')
c_file.write(' size_t i;\n')
c_file.write(' ret->len = YAJL_GET_OBJECT(tree)->len;\n')
- c_file.write(' ret->keys = safe_malloc((YAJL_GET_OBJECT(tree)->len + 1) ' \
- '* sizeof(*ret->keys));\n')
- c_file.write(' ret->%s = safe_malloc((YAJL_GET_OBJECT(tree)->len + 1) ' \
- '* sizeof(*ret->%s));\n' % (child.fixname, child.fixname))
+ c_file.write(' ret->keys = smart_safe_malloc(YAJL_GET_OBJECT(tree)->len, 1, ' \
+ 'sizeof(*ret->keys));\n')
+ c_file.write(' ret->%s = smart_safe_malloc(YAJL_GET_OBJECT(tree)->len, 1, ' \
+ 'sizeof(*ret->%s));\n' % (child.fixname, child.fixname))
c_file.write(' for (i = 0; i < YAJL_GET_OBJECT(tree)->len; i++) {\n')
c_file.write(' const char *tmpkey = YAJL_GET_OBJECT(tree)->keys[i];\n')
c_file.write(' ret->keys[i] = safe_strdup(tmpkey ? tmpkey : "");\n')
@@ -132,8 +132,8 @@ def parse_obj_type(obj, c_file, prefix, obj_typename):
' YAJL_GET_ARRAY(tmp)->len > 0) {\n')
c_file.write(' size_t i;\n')
c_file.write(' ret->%s_len = YAJL_GET_ARRAY(tmp)->len;\n' % (obj.fixname))
- c_file.write(' ret->%s = safe_malloc((YAJL_GET_ARRAY(tmp)->len + 1) ' \
- '* sizeof(*ret->%s));\n' % (obj.fixname, obj.fixname))
+ c_file.write(' ret->%s = smart_safe_malloc(YAJL_GET_ARRAY(tmp)->len, 1, ' \
+ 'sizeof(*ret->%s));\n' % (obj.fixname, obj.fixname))
c_file.write(' for (i = 0; i < YAJL_GET_ARRAY(tmp)->len; i++) {\n')
c_file.write(' yajl_val val = YAJL_GET_ARRAY(tmp)->values[i];\n')
c_file.write(' ret->%s[i] = make_%s(val, ctx, err);\n' \
@@ -166,8 +166,8 @@ def parse_obj_type(obj, c_file, prefix, obj_typename):
c_file.write(' size_t i;\n')
c_file.write(' ret->%s_len = YAJL_GET_ARRAY(tmp)->len;\n' % (obj.fixname))
c_file.write(
- ' ret->%s = safe_malloc((YAJL_GET_ARRAY(tmp)->len + 1) *' \
- ' sizeof(*ret->%s));\n' % (obj.fixname, obj.fixname))
+ ' ret->%s = smart_safe_malloc(YAJL_GET_ARRAY(tmp)->len, 1, ' \
+ 'sizeof(*ret->%s));\n' % (obj.fixname, obj.fixname))
c_file.write(' for (i = 0; i < YAJL_GET_ARRAY(tmp)->len; i++) {\n')
read_val_generator(c_file, 4, 'YAJL_GET_ARRAY(tmp)->values[i]', \
"ret->%s[i]" % obj.fixname, obj.subtyp, obj.origname, obj_typename)
@@ -891,7 +891,7 @@ def get_c_epilog(c_file, prefix, typ):
alen = YAJL_GET_ARRAY(tree)->len;
if (alen == 0)
return NULL;
- ptr = safe_malloc((alen + 1) * sizeof(%s_element *));
+ ptr = smart_safe_malloc(alen, 1, sizeof(%s_element *));
for (i = 0; i < alen; i++) {
yajl_val val = YAJL_GET_ARRAY(tree)->values[i];
ptr[i] = make_%s_element(val, ctx, err);
@@ -1001,6 +1001,12 @@ yajl_gen_status gen_%s(yajl_gen g, const %s_element **ptr, size_t len, const str
return NULL;
*err = NULL;
+ if (strlen(jsondata) >= JSON_MAX_SIZE) {
+ if (asprintf(err, "cannot parse the data with length exceeding %%llu", JSON_MAX_SIZE) < 0) {
+ *err = safe_strdup("error allocating memory");
+ }
+ return NULL;
+ }
if (ctx == NULL) {
ctx = (const struct parser_context *)(&tmp_ctx);
}
@@ -1049,7 +1055,7 @@ yajl_gen_status gen_%s(yajl_gen g, const %s_element **ptr, size_t len, const str
goto free_out;
}
- json_buf = safe_malloc(gen_len + 1);
+ json_buf = smart_safe_malloc(gen_len, 1, 1);
(void)memcpy(json_buf, gen_buf, gen_len);
json_buf[gen_len] = '\\0';
--
2.34.1
Reference in New Issue View Git Blame Copy Permalink