jcs
/subtext
/amendments
/225
bile: Pass object size to bile_unmarshall_object to check for overflow
Also add malloc annotations
jcs made amendment 225 over 2 years ago
--- bile.c Wed Jul 20 09:30:20 2022
+++ bile.c Sun Jul 31 22:37:40 2022
@@ -70,7 +70,7 @@ bile_create(const Str255 filename, short vrefnum, cons
return NULL;
SetFPos(fh, fsFromStart, 0);
- bile = xmalloczero(sizeof(struct bile));
+ bile = xmalloczero(sizeof(struct bile), "bile_create");
memcpy(bile->magic, BILE_MAGIC, sizeof(bile->magic));
bile->vrefnum = vrefnum;
bile->frefnum = fh;
@@ -79,7 +79,7 @@ bile_create(const Str255 filename, short vrefnum, cons
/* write magic */
len = BILE_MAGIC_LEN;
- tmp = xstrdup(BILE_MAGIC);
+ tmp = xstrdup(BILE_MAGIC, "bile_create magic");
_bile_error = FSWrite(bile->frefnum, &len, tmp);
xfree(&tmp);
if (_bile_error)
@@ -99,7 +99,7 @@ bile_create(const Str255 filename, short vrefnum, cons
/* padding */
len = BILE_HEADER_LEN - BILE_MAGIC_LEN - BILE_OBJECT_SIZE -
BILE_OBJECT_SIZE;
- tmp = xmalloczero(len);
+ tmp = xmalloczero(len, "bile_create padding");
_bile_error = FSWrite(bile->frefnum, &len, tmp);
if (_bile_error)
goto create_bail;
@@ -143,7 +143,7 @@ bile_open(const Str255 filename, short vrefnum)
GetFPos(fh, &file_size);
SetFPos(fh, fsFromStart, 0);
- bile = xmalloczero(sizeof(struct bile));
+ bile = xmalloczero(sizeof(struct bile), "bile_open");
memcpy(bile->magic, BILE_MAGIC, sizeof(bile->magic));
bile->vrefnum = vrefnum;
bile->frefnum = fh;
@@ -277,7 +277,7 @@ bile_find(struct bile *bile, const OSType type, const
if (o == NULL)
return NULL;
- ocopy = xmalloc(BILE_OBJECT_SIZE);
+ ocopy = xmalloc(BILE_OBJECT_SIZE, "bile_find");
memcpy(ocopy, o, BILE_OBJECT_SIZE);
return ocopy;
@@ -356,7 +356,7 @@ bile_get_nth_of_type(struct bile *bile, const unsigned
continue;
if (count == index) {
- ocopy = xmalloc(BILE_OBJECT_SIZE);
+ ocopy = xmalloc(BILE_OBJECT_SIZE, "bile_get_nth_of_type");
memcpy(ocopy, o, BILE_OBJECT_SIZE);
return ocopy;
}
@@ -586,7 +586,7 @@ bile_read_alloc(struct bile *bile, const OSType type,
return 0;
}
- *data = xmalloczero(o->size);
+ *data = xmalloczero(o->size, "bile_read_alloc");
ret = bile_read_object(bile, o, *data, o->size);
return ret;
@@ -689,7 +689,7 @@ iterate_fields:
}
if (!write) {
- data = xmalloc(size);
+ data = xmalloc(size, "bile_marshall_object");
write = true;
size = 0;
goto iterate_fields;
@@ -704,7 +704,8 @@ iterate_fields:
short
bile_unmarshall_object(struct bile *bile,
const struct bile_object_field *fields, const size_t nfields,
- const void *data, const size_t size, void *object, bool deep)
+ const void *data, const size_t data_size, void *object,
+ const size_t object_size, bool deep)
{
size_t off, fsize = 0, n;
char *ptr, *dptr;
@@ -719,7 +720,7 @@ bile_unmarshall_object(struct bile *bile,
} else
fsize = fields[n].size;
- if (off + fsize > size)
+ if (off + fsize > data_size)
panic("bile_unmarshall_object: overflow at field %lu of %lu!",
n + 1, nfields);
@@ -730,15 +731,21 @@ bile_unmarshall_object(struct bile *bile,
memset(ptr, 0, sizeof(dptr));
continue;
}
- dptr = xmalloc(fsize);
+ dptr = xmalloc(fsize, "bile_unmarshall_object");
memcpy(ptr, &dptr, sizeof(dptr));
ptr = dptr;
}
if (fields[n].size < 0 && !deep)
memset(ptr, 0, sizeof(dptr));
- else
+ else {
+ if (fields[n].size > 0 &&
+ fields[n].struct_off + fsize > object_size)
+ panic("bile_unmarshall_object: overflow writing to object "
+ "at field %lu! (%lu > %lu)", n + 1,
+ fields[n].struct_off + fsize, object_size);
memcpy(ptr, (char *)data + off, fsize);
+ }
off += fsize;
}
@@ -895,7 +902,7 @@ bile_read_map(struct bile *bile, struct bile_object *m
/* read entire map */
size = map_obj.size;
- map = xmalloczero(size);
+ map = xmalloczero(size, "bile_read_map");
_bile_error = FSRead(bile->frefnum, &size, map);
if (_bile_error) {
xfree(&map);
@@ -933,7 +940,7 @@ bile_write_map(struct bile *bile)
new_map_size = BILE_OBJECT_SIZE * new_nobjects;
new_map_obj = bile_alloc(bile, BILE_TYPE_MAP, new_map_id,
new_map_size);
- new_map = xcalloc(BILE_OBJECT_SIZE, new_nobjects);
+ new_map = xcalloc(BILE_OBJECT_SIZE, new_nobjects, "bile_write_map");
for (n = 0, new_nobjects = 0; n < bile->nobjects; n++) {
obj = &bile->map[n];
--- bile.h Tue Jul 19 14:44:43 2022
+++ bile.h Mon Jul 25 15:07:34 2022
@@ -141,6 +141,7 @@ short bile_marshall_object(struct bile *bile,
short bile_unmarshall_object(struct bile *bile,
const struct bile_object_field *fields,
const size_t nfields, const void *data,
- const size_t size, void *object, bool deep);
+ const size_t data_size, void *object,
+ const size_t object_size, bool deep);
#endif