Merge pull request #115 from FelixTUD/fix-buffer-overflow

Send/Receive buffer sizes adjustable in cmake as ISAAC_MAX_RECEIVE + added warnings/errors on overflow

Author: psychocoderHPC

server/CMakeLists.txt

@@ -78,6 +78,12 @@ if (ISAAC_GST)
 	add_definitions(-DISAAC_GST)
 endif (ISAAC_GST)
 
+
+
+set(ISAAC_MAX_RECEIVE "8388608" CACHE STRING "The size of the reserved buffers for sending and receiving, default of 8 MB should work for up to 4K" )
+set(ISAAC_DEFINITIONS ${ISAAC_DEFINITIONS} -DISAAC_MAX_RECEIVE=${ISAAC_MAX_RECEIVE})
+add_definitions(${ISAAC_DEFINITIONS})
+
 option(ISAAC_JPEG "Use JPEG compression between visualization and isaac server. Deactivating will not work with big images. And with big I am talking about bigger than 800x600." ON)
 if (ISAAC_JPEG)
 	find_package(JPEG REQUIRED)

server/src/Common.hpp

@@ -25,8 +25,6 @@ typedef int ClientRef;
 typedef int ObserverRef;
 typedef int errorCode;
 
-#define ISAAC_MAX_RECEIVE 4194304 //4 MB
-
 typedef enum
 {
 	FORCE_EXIT = -1,

server/src/InsituConnectorMaster.cpp

@@ -124,7 +124,15 @@ errorCode InsituConnectorMaster::run()
 					{
 						int add = recv(fd_array[i].fd,&(con_array[i]->connector->jlcb.buffer[con_array[i]->connector->jlcb.count]),4096,MSG_DONTWAIT);
 						if (add > 0)
+						{
 							con_array[i]->connector->jlcb.count += add;
+							if(con_array[i]->connector->jlcb.count > ISAAC_MAX_RECEIVE)
+							{
+								fprintf(stderr,"Fatal error: Socket received %d bytes but buffer is only %d bytes! To increase the allowed size set ISAAC_MAX_RECEIVE to a higher value.\n", 
+										con_array[i]->connector->jlcb.count, ISAAC_MAX_RECEIVE);
+								return -1;
+							}
+						}
 						else
 							break;
 					}

server/src/WebSocketDataConnector.cpp

@@ -23,6 +23,7 @@
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <assert.h>
+#include <vector>
 
 #include <syslog.h>
 #include <sys/time.h>
@@ -97,7 +98,7 @@ static int callback_isaac(
 		size_t len )
 {
 	int n, m;
-     
+
 	struct per_session_data__isaac *pss = (struct per_session_data__isaac *)user;
 	Broker** broker_ptr = (Broker**)lws_context_user(lws_get_context(wsi));
 	Broker* broker = NULL;
@@ -115,10 +116,6 @@ static int callback_isaac(
 	case LWS_CALLBACK_SERVER_WRITEABLE:
 		if (pss->client)
 		{
-            char* buf = new char[LWS_SEND_BUFFER_PRE_PADDING + ISAAC_MAX_RECEIVE +
-                        LWS_SEND_BUFFER_POST_PADDING];
-                         
-            char *p = &buf[LWS_SEND_BUFFER_PRE_PADDING];
 			MessageContainer* message = NULL;
 			int l = 0;
 			do
@@ -130,6 +127,7 @@ static int callback_isaac(
 				{
 					printf("WebSocketDataConnector: Dropped one dropable package!\n");
 					delete message;
+					message = NULL;
 					l--;
 				}
 				if (message) //New message from master sama!
@@ -138,6 +136,17 @@ static int callback_isaac(
 					char* buffer = json_dumps( message->json_root, 0 );
 					pthread_mutex_unlock(&MessageContainer::deep_copy_mutex);
 					n = strlen(buffer);
+
+					std::vector<char> buf(LWS_SEND_BUFFER_PRE_PADDING + n + LWS_SEND_BUFFER_POST_PADDING + 1);
+					if(buf.size() > ISAAC_MAX_RECEIVE)
+					{
+						printf("The maximum set size of %d bytes per lws packet was exceeded! To increase the allowed package size set ISAAC_MAX_RECEIVE to a higher value. \n", 
+							ISAAC_MAX_RECEIVE);
+						fflush(stdout);
+					}
+
+					char *p = buf.data() + LWS_SEND_BUFFER_PRE_PADDING;
+
 					sprintf(p,"%s",buffer);
 					m = lws_write(wsi, (unsigned char*)p, n, LWS_WRITE_TEXT);
 					free(buffer);
@@ -148,10 +157,10 @@ static int callback_isaac(
 						return -1;
 					}
 					delete message;
+					message = NULL;
 				}
 			}
 			while (l > 1 && !lws_send_pipe_choked(wsi));
-            delete[] buf;
 		}
 		break;
 	//case LWS_CALLBACK_CLOSED: