Skip to content

Commit ec8c0bc

Browse files
redboltzredboltz
committed
Fixed #774.
Added checking code for snprintf return value.
1 parent ce088e7 commit ec8c0bc

File tree

1 file changed

+47
-124
lines changed

1 file changed

+47
-124
lines changed

‎src/objectc.c‎

Lines changed: 47 additions & 124 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,12 @@ void msgpack_object_print(FILE* out, msgpack_object o)
254254

255255
#endif
256256

257+
#define MSGPACK_CHECKED_CALL(ret, func, aux_buffer, aux_buffer_size, ...) \
258+
ret = func(aux_buffer, aux_buffer_size, __VA_ARGS__); \
259+
if (ret <= 0 || ret > (int)aux_buffer_size) return 0; \
260+
aux_buffer = aux_buffer + ret; \
261+
aux_buffer_size = aux_buffer_size - ret \
262+
257263
static int msgpack_object_bin_print_buffer(char *buffer, size_t buffer_size, const char *ptr, size_t size)
258264
{
259265
size_t i;
@@ -263,19 +269,15 @@ static int msgpack_object_bin_print_buffer(char *buffer, size_t buffer_size, con
263269

264270
for (i = 0; i < size; ++i) {
265271
if (ptr[i] == '"') {
266-
ret = snprintf(aux_buffer, aux_buffer_size, "\\\"");
267-
aux_buffer = aux_buffer + ret;
268-
aux_buffer_size = aux_buffer_size - ret;
272+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\\\"");
269273
} else if (isprint((unsigned char)ptr[i])) {
270274
if (aux_buffer_size > 0) {
271275
memcpy(aux_buffer, ptr + i, 1);
272276
aux_buffer = aux_buffer + 1;
273277
aux_buffer_size = aux_buffer_size - 1;
274278
}
275279
} else {
276-
ret = snprintf(aux_buffer, aux_buffer_size, "\\x%02x", (unsigned char)ptr[i]);
277-
aux_buffer = aux_buffer + ret;
278-
aux_buffer_size = aux_buffer_size - ret;
280+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\\x%02x", (unsigned char)ptr[i]);
279281
}
280282
}
281283

@@ -289,197 +291,118 @@ int msgpack_object_print_buffer(char *buffer, size_t buffer_size, msgpack_object
289291
int ret;
290292
switch(o.type) {
291293
case MSGPACK_OBJECT_NIL:
292-
ret = snprintf(aux_buffer, aux_buffer_size, "nil");
293-
aux_buffer = aux_buffer + ret;
294-
aux_buffer_size = aux_buffer_size - ret;
294+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "nil");
295295
break;
296296

297297
case MSGPACK_OBJECT_BOOLEAN:
298-
ret = snprintf(aux_buffer, aux_buffer_size, (o.via.boolean ? "true" : "false"));
299-
aux_buffer = aux_buffer + ret;
300-
aux_buffer_size = aux_buffer_size - ret;
298+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, (o.via.boolean ? "true" : "false"));
301299
break;
302300

303301
case MSGPACK_OBJECT_POSITIVE_INTEGER:
304302
#if defined(PRIu64)
305-
ret = snprintf(aux_buffer, aux_buffer_size, "%" PRIu64, o.via.u64);
306-
aux_buffer = aux_buffer + ret;
307-
aux_buffer_size = aux_buffer_size - ret;
303+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "%" PRIu64, o.via.u64);
308304
#else
309305
if (o.via.u64 > ULONG_MAX) {
310-
ret = snprintf(aux_buffer, aux_buffer_size, "over 4294967295");
311-
aux_buffer = aux_buffer + ret;
312-
aux_buffer_size = aux_buffer_size - ret;
306+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "over 4294967295");
313307
} else {
314-
ret = snprintf(aux_buffer, aux_buffer_size, "%lu", (unsigned long)o.via.u64);
315-
aux_buffer = aux_buffer + ret;
316-
aux_buffer_size = aux_buffer_size - ret;
308+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "%lu", (unsigned long)o.via.u64);
317309
}
318310
#endif
319311
break;
320312

321313
case MSGPACK_OBJECT_NEGATIVE_INTEGER:
322314
#if defined(PRIi64)
323-
ret = snprintf(aux_buffer, aux_buffer_size, "%" PRIi64, o.via.i64);
324-
aux_buffer = aux_buffer + ret;
325-
aux_buffer_size = aux_buffer_size - ret;
315+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "%" PRIi64, o.via.i64);
326316
#else
327317
if (o.via.i64 > LONG_MAX) {
328-
ret = snprintf(aux_buffer, aux_buffer_size, "over +2147483647");
329-
aux_buffer = aux_buffer + ret;
330-
aux_buffer_size = aux_buffer_size - ret;
318+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "over +2147483647");
331319
} else if (o.via.i64 < LONG_MIN) {
332-
ret = snprintf(aux_buffer, aux_buffer_size, "under -2147483648");
333-
aux_buffer = aux_buffer + ret;
334-
aux_buffer_size = aux_buffer_size - ret;
320+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "under -2147483648");
335321
} else {
336-
ret = snprintf(aux_buffer, aux_buffer_size, "%ld", (signed long)o.via.i64);
337-
aux_buffer = aux_buffer + ret;
338-
aux_buffer_size = aux_buffer_size - ret;
322+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "%ld", (signed long)o.via.i64);
339323
}
340324
#endif
341325
break;
342326

343327
case MSGPACK_OBJECT_FLOAT32:
344328
case MSGPACK_OBJECT_FLOAT64:
345-
ret = snprintf(aux_buffer, aux_buffer_size, "%f", o.via.f64);
346-
aux_buffer = aux_buffer + ret;
347-
aux_buffer_size = aux_buffer_size - ret;
329+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "%f", o.via.f64);
348330
break;
349331

350332
case MSGPACK_OBJECT_STR:
351-
ret = snprintf(aux_buffer, aux_buffer_size, "\"");
352-
aux_buffer = aux_buffer + ret;
353-
aux_buffer_size = aux_buffer_size - ret;
354-
ret = snprintf(aux_buffer, aux_buffer_size, "%.*s", (int)o.via.str.size, o.via.str.ptr);
355-
aux_buffer = aux_buffer + ret;
356-
aux_buffer_size = aux_buffer_size - ret;
357-
ret = snprintf(aux_buffer, aux_buffer_size, "\"");
358-
aux_buffer = aux_buffer + ret;
359-
aux_buffer_size = aux_buffer_size - ret;
333+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\"");
334+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "%.*s", (int)o.via.str.size, o.via.str.ptr);
335+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\"");
360336
break;
361337

362338
case MSGPACK_OBJECT_BIN:
363-
ret = snprintf(aux_buffer, aux_buffer_size, "\"");
364-
aux_buffer = aux_buffer + ret;
365-
aux_buffer_size = aux_buffer_size - ret;
366-
367-
ret = msgpack_object_bin_print_buffer(aux_buffer, aux_buffer_size, o.via.bin.ptr, o.via.bin.size);
368-
aux_buffer = aux_buffer + ret;
369-
aux_buffer_size = aux_buffer_size - ret;
370-
371-
ret = snprintf(aux_buffer, aux_buffer_size, "\"");
372-
aux_buffer = aux_buffer + ret;
373-
aux_buffer_size = aux_buffer_size - ret;
339+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\"");
340+
MSGPACK_CHECKED_CALL(ret, msgpack_object_bin_print_buffer, aux_buffer, aux_buffer_size, o.via.bin.ptr, o.via.bin.size);
341+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\"");
374342
break;
375343

376344
case MSGPACK_OBJECT_EXT:
377345
#if defined(PRIi8)
378-
ret = snprintf(aux_buffer, aux_buffer_size, "(ext: %" PRIi8 ")", o.via.ext.type);
379-
aux_buffer = aux_buffer + ret;
380-
aux_buffer_size = aux_buffer_size - ret;
346+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "(ext: %" PRIi8 ")", o.via.ext.type);
381347
#else
382-
ret = snprintf(aux_buffer, aux_buffer_size, "(ext: %d)", (int)o.via.ext.type);
383-
aux_buffer = aux_buffer + ret;
384-
aux_buffer_size = aux_buffer_size - ret;
348+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "(ext: %d)", (int)o.via.ext.type);
385349
#endif
386-
ret = snprintf(aux_buffer, aux_buffer_size, "\"");
387-
aux_buffer = aux_buffer + ret;
388-
aux_buffer_size = aux_buffer_size - ret;
389-
390-
ret = msgpack_object_bin_print_buffer(aux_buffer, aux_buffer_size, o.via.ext.ptr, o.via.ext.size);
391-
aux_buffer = aux_buffer + ret;
392-
aux_buffer_size = aux_buffer_size - ret;
393-
394-
ret = snprintf(aux_buffer, aux_buffer_size, "\"");
395-
aux_buffer = aux_buffer + ret;
396-
aux_buffer_size = aux_buffer_size - ret;
350+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\"");
351+
MSGPACK_CHECKED_CALL(ret, msgpack_object_bin_print_buffer, aux_buffer, aux_buffer_size, o.via.ext.ptr, o.via.ext.size);
352+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\"");
397353
break;
398354

399355
case MSGPACK_OBJECT_ARRAY:
400-
ret = snprintf(aux_buffer, aux_buffer_size, "[");
401-
aux_buffer = aux_buffer + ret;
402-
aux_buffer_size = aux_buffer_size - ret;
356+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "[");
403357
if(o.via.array.size != 0) {
404358
msgpack_object* p = o.via.array.ptr;
405359
msgpack_object* const pend = o.via.array.ptr + o.via.array.size;
406-
ret = msgpack_object_print_buffer(aux_buffer, aux_buffer_size, *p);
407-
aux_buffer = aux_buffer + ret;
408-
aux_buffer_size = aux_buffer_size - ret;
360+
MSGPACK_CHECKED_CALL(ret, msgpack_object_print_buffer, aux_buffer, aux_buffer_size, *p);
409361
++p;
410362
for(; p < pend; ++p) {
411-
ret = snprintf(aux_buffer, aux_buffer_size, ", ");
412-
aux_buffer = aux_buffer + ret;
413-
aux_buffer_size = aux_buffer_size - ret;
414-
ret = msgpack_object_print_buffer(aux_buffer, aux_buffer_size, *p);
415-
aux_buffer = aux_buffer + ret;
416-
aux_buffer_size = aux_buffer_size - ret;
363+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, ", ");
364+
MSGPACK_CHECKED_CALL(ret, msgpack_object_print_buffer, aux_buffer, aux_buffer_size, *p);
417365
}
418366
}
419-
ret = snprintf(aux_buffer, aux_buffer_size, "]");
420-
aux_buffer = aux_buffer + ret;
421-
aux_buffer_size = aux_buffer_size - ret;
367+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "]");
422368
break;
423369

424370
case MSGPACK_OBJECT_MAP:
425-
ret = snprintf(aux_buffer, aux_buffer_size, "{");
426-
aux_buffer = aux_buffer + ret;
427-
aux_buffer_size = aux_buffer_size - ret;
371+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "{");
428372
if(o.via.map.size != 0) {
429373
msgpack_object_kv* p = o.via.map.ptr;
430374
msgpack_object_kv* const pend = o.via.map.ptr + o.via.map.size;
431-
ret = msgpack_object_print_buffer(aux_buffer, aux_buffer_size, p->key);
432-
aux_buffer = aux_buffer + ret;
433-
aux_buffer_size = aux_buffer_size - ret;
434-
ret = snprintf(aux_buffer, aux_buffer_size, "=>");
435-
aux_buffer = aux_buffer + ret;
436-
aux_buffer_size = aux_buffer_size - ret;
437-
ret = msgpack_object_print_buffer(aux_buffer, aux_buffer_size, p->val);
438-
aux_buffer = aux_buffer + ret;
439-
aux_buffer_size = aux_buffer_size - ret;
375+
MSGPACK_CHECKED_CALL(ret, msgpack_object_print_buffer, aux_buffer, aux_buffer_size, p->key);
376+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "=>");
377+
MSGPACK_CHECKED_CALL(ret, msgpack_object_print_buffer, aux_buffer, aux_buffer_size, p->val);
440378
++p;
441379
for(; p < pend; ++p) {
442-
ret = snprintf(aux_buffer, aux_buffer_size, ", ");
443-
aux_buffer = aux_buffer + ret;
444-
aux_buffer_size = aux_buffer_size - ret;
445-
ret = msgpack_object_print_buffer(aux_buffer, aux_buffer_size, p->key);
446-
aux_buffer = aux_buffer + ret;
447-
aux_buffer_size = aux_buffer_size - ret;
448-
ret = snprintf(aux_buffer, aux_buffer_size, "=>");
449-
aux_buffer = aux_buffer + ret;
450-
aux_buffer_size = aux_buffer_size - ret;
451-
ret = msgpack_object_print_buffer(aux_buffer, aux_buffer_size, p->val);
452-
aux_buffer = aux_buffer + ret;
453-
aux_buffer_size = aux_buffer_size - ret;
380+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, ", ");
381+
MSGPACK_CHECKED_CALL(ret, msgpack_object_print_buffer, aux_buffer, aux_buffer_size, p->key);
382+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "=>");
383+
MSGPACK_CHECKED_CALL(ret, msgpack_object_print_buffer, aux_buffer, aux_buffer_size, p->val);
454384
}
455385
}
456-
ret = snprintf(aux_buffer, aux_buffer_size, "}");
457-
aux_buffer = aux_buffer + ret;
458-
aux_buffer_size = aux_buffer_size - ret;
386+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "}");
459387
break;
460388

461389
default:
462390
// FIXME
463391
#if defined(PRIu64)
464-
ret = snprintf(aux_buffer, aux_buffer_size, "#<UNKNOWN %i %" PRIu64 ">", o.type, o.via.u64);
465-
aux_buffer = aux_buffer + ret;
466-
aux_buffer_size = aux_buffer_size - ret;
392+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "#<UNKNOWN %i %" PRIu64 ">", o.type, o.via.u64);
467393
#else
468394
if (o.via.u64 > ULONG_MAX) {
469-
ret = snprintf(aux_buffer, aux_buffer_size, "#<UNKNOWN %i over 4294967295>", o.type);
470-
aux_buffer = aux_buffer + ret;
471-
aux_buffer_size = aux_buffer_size - ret;
395+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "#<UNKNOWN %i over 4294967295>", o.type);
472396
} else {
473-
ret = snprintf(aux_buffer, aux_buffer_size, "#<UNKNOWN %i %lu>", o.type, (unsigned long)o.via.u64);
474-
aux_buffer = aux_buffer + ret;
475-
aux_buffer_size = aux_buffer_size - ret;
397+
MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "#<UNKNOWN %i %lu>", o.type, (unsigned long)o.via.u64);
476398
}
477399
#endif
478400
}
479401

480402
return (int)(buffer_size - aux_buffer_size);
481403
}
482404

405+
#undef MSGPACK_CHECKED_CALL
483406

484407
bool msgpack_object_equal(const msgpack_object x, const msgpack_object y)
485408
{

0 commit comments

Comments
 (0)