Skip to content

Commit 5cc9de5

Browse files
kashifkhankashifkhan
authored
use safe math (#381)
1 parent 6dada63 commit 5cc9de5

File tree

1 file changed

+130
-83
lines changed

1 file changed

+130
-83
lines changed

‎src/vendor/azure-uamqp-c/src/message.c‎

Lines changed: 130 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
#include "azure_macro_utils/macro_utils.h"
88
#include "azure_c_shared_utility/gballoc.h"
99
#include "azure_c_shared_utility/xlogging.h"
10+
#include "azure_c_shared_utility/safe_math.h"
1011
#include "azure_uamqp_c/amqp_definitions.h"
1112
#include "azure_uamqp_c/message.h"
1213
#include "azure_uamqp_c/amqpvalue.h"
@@ -67,6 +68,7 @@ static void free_all_body_data_items(MESSAGE_HANDLE message)
6768
if (message->body_amqp_data_items[i].body_data_section_bytes != NULL)
6869
{
6970
free(message->body_amqp_data_items[i].body_data_section_bytes);
71+
message->body_amqp_data_items[i].body_data_section_bytes = NULL;
7072
}
7173
}
7274

@@ -241,81 +243,103 @@ MESSAGE_HANDLE message_clone(MESSAGE_HANDLE source_message)
241243
result = NULL;
242244
}
243245
}
244-
245246
if ((result != NULL) && (source_message->body_amqp_data_count > 0))
246247
{
247-
size_t i;
248+
size_t calloc_size = safe_multiply_size_t(source_message->body_amqp_data_count, sizeof(BODY_AMQP_DATA));
248249

249-
result->body_amqp_data_items = (BODY_AMQP_DATA*)calloc(1, (source_message->body_amqp_data_count * sizeof(BODY_AMQP_DATA)));
250-
if (result->body_amqp_data_items == NULL)
250+
if (calloc_size == SIZE_MAX)
251251
{
252-
/* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
253-
LogError("Cannot allocate memory for body data sections");
252+
LogError("Invalid size for body_amqp_data_items");
254253
message_destroy(result);
255254
result = NULL;
256255
}
257256
else
258257
{
259-
for (i = 0; i < source_message->body_amqp_data_count; i++)
258+
result->body_amqp_data_items = (BODY_AMQP_DATA*)calloc(1, calloc_size);
259+
260+
if (result->body_amqp_data_items == NULL)
260261
{
261-
result->body_amqp_data_items[i].body_data_section_length = source_message->body_amqp_data_items[i].body_data_section_length;
262+
/* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
263+
LogError("Cannot allocate memory for body data sections");
264+
message_destroy(result);
265+
result = NULL;
266+
}
267+
else
268+
{
269+
size_t i;
262270

263-
/* Codes_SRS_MESSAGE_01_011: [If an AMQP data has been set as message body on the source message it shall be cloned by allocating memory for the binary payload.] */
264-
result->body_amqp_data_items[i].body_data_section_bytes = (unsigned char*)malloc(source_message->body_amqp_data_items[i].body_data_section_length);
265-
if (result->body_amqp_data_items[i].body_data_section_bytes == NULL)
271+
for (i = 0; i < source_message->body_amqp_data_count; i++)
266272
{
267-
LogError("Cannot allocate memory for body data section %u", (unsigned int)i);
268-
break;
273+
result->body_amqp_data_items[i].body_data_section_length = source_message->body_amqp_data_items[i].body_data_section_length;
274+
275+
/* Codes_SRS_MESSAGE_01_011: [If an AMQP data has been set as message body on the source message it shall be cloned by allocating memory for the binary payload.] */
276+
result->body_amqp_data_items[i].body_data_section_bytes = (unsigned char*)malloc(source_message->body_amqp_data_items[i].body_data_section_length);
277+
if (result->body_amqp_data_items[i].body_data_section_bytes == NULL)
278+
{
279+
LogError("Cannot allocate memory for body data section %u", (unsigned int)i);
280+
break;
281+
}
282+
else
283+
{
284+
(void)memcpy(result->body_amqp_data_items[i].body_data_section_bytes, source_message->body_amqp_data_items[i].body_data_section_bytes, result->body_amqp_data_items[i].body_data_section_length);
285+
}
269286
}
270-
else
287+
288+
result->body_amqp_data_count = i;
289+
if (i < source_message->body_amqp_data_count)
271290
{
272-
(void)memcpy(result->body_amqp_data_items[i].body_data_section_bytes, source_message->body_amqp_data_items[i].body_data_section_bytes, result->body_amqp_data_items[i].body_data_section_length);
291+
/* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
292+
message_destroy(result);
293+
result = NULL;
273294
}
274295
}
275-
276-
result->body_amqp_data_count = i;
277-
if (i < source_message->body_amqp_data_count)
278-
{
279-
/* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
280-
message_destroy(result);
281-
result = NULL;
282-
}
283296
}
284297
}
285298

286299
if ((result != NULL) && (source_message->body_amqp_sequence_count > 0))
287300
{
288-
size_t i;
301+
size_t calloc_size = safe_multiply_size_t(source_message->body_amqp_sequence_count, sizeof(AMQP_VALUE));
289302

290-
result->body_amqp_sequence_items = (AMQP_VALUE*)calloc(1, (source_message->body_amqp_sequence_count * sizeof(AMQP_VALUE)));
291-
if (result->body_amqp_sequence_items == NULL)
303+
if (calloc_size == SIZE_MAX)
292304
{
293-
/* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
294-
LogError("Cannot allocate memory for body AMQP sequences");
305+
LogError("Invalid size for body_amqp_sequence_items");
295306
message_destroy(result);
296307
result = NULL;
297308
}
298309
else
299310
{
300-
for (i = 0; i < source_message->body_amqp_sequence_count; i++)
301-
{
302-
/* Codes_SRS_MESSAGE_01_160: [ If AMQP sequences are set as AMQP body they shall be cloned by calling `amqpvalue_clone`. ] */
303-
result->body_amqp_sequence_items[i] = amqpvalue_clone(source_message->body_amqp_sequence_items[i]);
304-
if (result->body_amqp_sequence_items[i] == NULL)
305-
{
306-
LogError("Cannot clone AMQP sequence %u", (unsigned int)i);
307-
break;
308-
}
309-
}
310-
311-
result->body_amqp_sequence_count = i;
312-
if (i < source_message->body_amqp_sequence_count)
311+
result->body_amqp_sequence_items = (AMQP_VALUE*)calloc(1, calloc_size);
312+
if (result->body_amqp_sequence_items == NULL)
313313
{
314314
/* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
315+
LogError("Cannot allocate memory for body AMQP sequences");
315316
message_destroy(result);
316317
result = NULL;
317318
}
318-
}
319+
else
320+
{
321+
size_t i;
322+
323+
for (i = 0; i < source_message->body_amqp_sequence_count; i++)
324+
{
325+
/* Codes_SRS_MESSAGE_01_160: [ If AMQP sequences are set as AMQP body they shall be cloned by calling `amqpvalue_clone`. ] */
326+
result->body_amqp_sequence_items[i] = amqpvalue_clone(source_message->body_amqp_sequence_items[i]);
327+
if (result->body_amqp_sequence_items[i] == NULL)
328+
{
329+
LogError("Cannot clone AMQP sequence %u", (unsigned int)i);
330+
break;
331+
}
332+
}
333+
334+
result->body_amqp_sequence_count = i;
335+
if (i < source_message->body_amqp_sequence_count)
336+
{
337+
/* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
338+
message_destroy(result);
339+
result = NULL;
340+
}
341+
}
342+
}
319343
}
320344

321345
if ((result != NULL) && (source_message->body_amqp_value != NULL))
@@ -1016,7 +1040,7 @@ int message_add_body_amqp_data(MESSAGE_HANDLE message, BINARY_DATA amqp_data)
10161040
if ((message == NULL) ||
10171041
/* Tests_SRS_MESSAGE_01_089: [ If the `bytes` member of `amqp_data` is NULL and the `size` member is non-zero, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
10181042
((amqp_data.bytes == NULL) &&
1019-
(amqp_data.length != 0)))
1043+
(amqp_data.length != 0)))
10201044
{
10211045
LogError("Bad arguments: message = %p, bytes = %p, length = %u",
10221046
message, amqp_data.bytes, (unsigned int)amqp_data.length);
@@ -1034,45 +1058,56 @@ int message_add_body_amqp_data(MESSAGE_HANDLE message, BINARY_DATA amqp_data)
10341058
}
10351059
else
10361060
{
1037-
/* Codes_SRS_MESSAGE_01_086: [ `message_add_body_amqp_data` shall add the contents of `amqp_data` to the list of AMQP data values for the body of the message identified by `message`. ]*/
1038-
BODY_AMQP_DATA* new_body_amqp_data_items = (BODY_AMQP_DATA*)realloc(message->body_amqp_data_items, sizeof(BODY_AMQP_DATA) * (message->body_amqp_data_count + 1));
1039-
if (new_body_amqp_data_items == NULL)
1061+
size_t realloc_size = safe_add_size_t(message->body_amqp_data_count, 1);
1062+
realloc_size = safe_multiply_size_t(sizeof(BODY_AMQP_DATA), realloc_size);
1063+
1064+
if (realloc_size == SIZE_MAX)
10401065
{
1041-
/* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
1042-
LogError("Cannot allocate memory for body AMQP data items");
1066+
LogError("Invalid size for new_body_amqp_data_items");
10431067
result = MU_FAILURE;
10441068
}
10451069
else
10461070
{
1047-
message->body_amqp_data_items = new_body_amqp_data_items;
1048-
1049-
if (amqp_data.length == 0)
1071+
/* Codes_SRS_MESSAGE_01_086: [ `message_add_body_amqp_data` shall add the contents of `amqp_data` to the list of AMQP data values for the body of the message identified by `message`. ]*/
1072+
BODY_AMQP_DATA* new_body_amqp_data_items = (BODY_AMQP_DATA*)realloc(message->body_amqp_data_items, realloc_size);
1073+
if (new_body_amqp_data_items == NULL)
10501074
{
1051-
message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = NULL;
1052-
message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = 0;
1053-
message->body_amqp_data_count++;
1054-
1055-
/* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
1056-
result = 0;
1075+
/* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
1076+
LogError("Cannot allocate memory for body AMQP data items");
1077+
result = MU_FAILURE;
10571078
}
10581079
else
10591080
{
1060-
message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = (unsigned char*)malloc(amqp_data.length);
1061-
if (message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes == NULL)
1062-
{
1063-
/* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
1064-
LogError("Cannot allocate memory for body AMQP data to be added");
1065-
result = MU_FAILURE;
1066-
}
1067-
else
1081+
message->body_amqp_data_items = new_body_amqp_data_items;
1082+
1083+
if (amqp_data.length == 0)
10681084
{
1069-
message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = amqp_data.length;
1070-
(void)memcpy(message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes, amqp_data.bytes, amqp_data.length);
1085+
message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = NULL;
1086+
message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = 0;
10711087
message->body_amqp_data_count++;
10721088

10731089
/* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
10741090
result = 0;
10751091
}
1092+
else
1093+
{
1094+
message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = (unsigned char*)malloc(amqp_data.length);
1095+
if (message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes == NULL)
1096+
{
1097+
/* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
1098+
LogError("Cannot allocate memory for body AMQP data to be added");
1099+
result = MU_FAILURE;
1100+
}
1101+
else
1102+
{
1103+
message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = amqp_data.length;
1104+
(void)memcpy(message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes, amqp_data.bytes, amqp_data.length);
1105+
message->body_amqp_data_count++;
1106+
1107+
/* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
1108+
result = 0;
1109+
}
1110+
}
10761111
}
10771112
}
10781113
}
@@ -1267,33 +1302,45 @@ int message_add_body_amqp_sequence(MESSAGE_HANDLE message, AMQP_VALUE sequence_l
12671302
}
12681303
else
12691304
{
1270-
AMQP_VALUE* new_body_amqp_sequence_items = (AMQP_VALUE*)realloc(message->body_amqp_sequence_items, sizeof(AMQP_VALUE) * (message->body_amqp_sequence_count + 1));
1271-
if (new_body_amqp_sequence_items == NULL)
1305+
size_t realloc_size = safe_add_size_t(message->body_amqp_sequence_count, 1);
1306+
realloc_size = safe_multiply_size_t(sizeof(AMQP_VALUE), realloc_size);
1307+
1308+
if (realloc_size == SIZE_MAX)
12721309
{
1273-
/* Codes_SRS_MESSAGE_01_158: [ If allocating memory in order to store the sequence fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
1274-
LogError("Cannot allocate enough memory for sequence items");
1310+
LogError("Invalid size for new_body_amqp_sequence_items");
12751311
result = MU_FAILURE;
12761312
}
12771313
else
12781314
{
1279-
message->body_amqp_sequence_items = new_body_amqp_sequence_items;
1315+
AMQP_VALUE* new_body_amqp_sequence_items = (AMQP_VALUE*)realloc(message->body_amqp_sequence_items, realloc_size);
12801316

1281-
/* Codes_SRS_MESSAGE_01_110: [ `message_add_body_amqp_sequence` shall add the contents of `sequence` to the list of AMQP sequences for the body of the message identified by `message`. ]*/
1282-
/* Codes_SRS_MESSAGE_01_156: [ The AMQP sequence shall be cloned by calling `amqpvalue_clone`. ]*/
1283-
message->body_amqp_sequence_items[message->body_amqp_sequence_count] = amqpvalue_clone(sequence_list);
1284-
if (message->body_amqp_sequence_items[message->body_amqp_sequence_count] == NULL)
1317+
if (new_body_amqp_sequence_items == NULL)
12851318
{
1286-
/* Codes_SRS_MESSAGE_01_157: [ If `amqpvalue_clone` fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
1287-
LogError("Cloning sequence failed");
1319+
/* Codes_SRS_MESSAGE_01_158: [ If allocating memory in order to store the sequence fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
1320+
LogError("Cannot allocate enough memory for sequence items");
12881321
result = MU_FAILURE;
12891322
}
12901323
else
12911324
{
1292-
/* Codes_SRS_MESSAGE_01_114: [ If adding the AMQP sequence fails, the previous value shall be preserved. ]*/
1293-
message->body_amqp_sequence_count++;
1325+
message->body_amqp_sequence_items = new_body_amqp_sequence_items;
12941326

1295-
/* Codes_SRS_MESSAGE_01_111: [ On success it shall return 0. ]*/
1296-
result = 0;
1327+
/* Codes_SRS_MESSAGE_01_110: [ `message_add_body_amqp_sequence` shall add the contents of `sequence` to the list of AMQP sequences for the body of the message identified by `message`. ]*/
1328+
/* Codes_SRS_MESSAGE_01_156: [ The AMQP sequence shall be cloned by calling `amqpvalue_clone`. ]*/
1329+
message->body_amqp_sequence_items[message->body_amqp_sequence_count] = amqpvalue_clone(sequence_list);
1330+
if (message->body_amqp_sequence_items[message->body_amqp_sequence_count] == NULL)
1331+
{
1332+
/* Codes_SRS_MESSAGE_01_157: [ If `amqpvalue_clone` fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
1333+
LogError("Cloning sequence failed");
1334+
result = MU_FAILURE;
1335+
}
1336+
else
1337+
{
1338+
/* Codes_SRS_MESSAGE_01_114: [ If adding the AMQP sequence fails, the previous value shall be preserved. ]*/
1339+
message->body_amqp_sequence_count++;
1340+
1341+
/* Codes_SRS_MESSAGE_01_111: [ On success it shall return 0. ]*/
1342+
result = 0;
1343+
}
12971344
}
12981345
}
12991346
}
@@ -1442,7 +1489,7 @@ int message_set_message_format(MESSAGE_HANDLE message, uint32_t message_format)
14421489
return result;
14431490
}
14441491

1445-
int message_get_message_format(MESSAGE_HANDLE message, uint32_t *message_format)
1492+
int message_get_message_format(MESSAGE_HANDLE message, uint32_t* message_format)
14461493
{
14471494
int result;
14481495

0 commit comments

Comments
 (0)