AmendHub

jcs

/

subtext

/

amendments

/

225

bile: Pass object size to bile_unmarshall_object to check for overflow

Also add malloc annotations

jcs made amendment 225 2 months ago
--- bile.c Wed Jul 20 09:30:20 2022 +++ bile.c Sun Jul 31 22:37:40 2022 @@ -70,7 +70,7 @@ bile_create(const Str255 filename, short vrefnum, cons return NULL; SetFPos(fh, fsFromStart, 0); - bile = xmalloczero(sizeof(struct bile)); + bile = xmalloczero(sizeof(struct bile), "bile_create"); memcpy(bile->magic, BILE_MAGIC, sizeof(bile->magic)); bile->vrefnum = vrefnum; bile->frefnum = fh; @@ -79,7 +79,7 @@ bile_create(const Str255 filename, short vrefnum, cons /* write magic */ len = BILE_MAGIC_LEN; - tmp = xstrdup(BILE_MAGIC); + tmp = xstrdup(BILE_MAGIC, "bile_create magic"); _bile_error = FSWrite(bile->frefnum, &len, tmp); xfree(&tmp); if (_bile_error) @@ -99,7 +99,7 @@ bile_create(const Str255 filename, short vrefnum, cons /* padding */ len = BILE_HEADER_LEN - BILE_MAGIC_LEN - BILE_OBJECT_SIZE - BILE_OBJECT_SIZE; - tmp = xmalloczero(len); + tmp = xmalloczero(len, "bile_create padding"); _bile_error = FSWrite(bile->frefnum, &len, tmp); if (_bile_error) goto create_bail; @@ -143,7 +143,7 @@ bile_open(const Str255 filename, short vrefnum) GetFPos(fh, &file_size); SetFPos(fh, fsFromStart, 0); - bile = xmalloczero(sizeof(struct bile)); + bile = xmalloczero(sizeof(struct bile), "bile_open"); memcpy(bile->magic, BILE_MAGIC, sizeof(bile->magic)); bile->vrefnum = vrefnum; bile->frefnum = fh; @@ -277,7 +277,7 @@ bile_find(struct bile *bile, const OSType type, const if (o == NULL) return NULL; - ocopy = xmalloc(BILE_OBJECT_SIZE); + ocopy = xmalloc(BILE_OBJECT_SIZE, "bile_find"); memcpy(ocopy, o, BILE_OBJECT_SIZE); return ocopy; @@ -356,7 +356,7 @@ bile_get_nth_of_type(struct bile *bile, const unsigned continue; if (count == index) { - ocopy = xmalloc(BILE_OBJECT_SIZE); + ocopy = xmalloc(BILE_OBJECT_SIZE, "bile_get_nth_of_type"); memcpy(ocopy, o, BILE_OBJECT_SIZE); return ocopy; } @@ -586,7 +586,7 @@ bile_read_alloc(struct bile *bile, const OSType type, return 0; } - *data = xmalloczero(o->size); + *data = xmalloczero(o->size, "bile_read_alloc"); ret = bile_read_object(bile, o, *data, o->size); return ret; @@ -689,7 +689,7 @@ iterate_fields: } if (!write) { - data = xmalloc(size); + data = xmalloc(size, "bile_marshall_object"); write = true; size = 0; goto iterate_fields; @@ -704,7 +704,8 @@ iterate_fields: short bile_unmarshall_object(struct bile *bile, const struct bile_object_field *fields, const size_t nfields, - const void *data, const size_t size, void *object, bool deep) + const void *data, const size_t data_size, void *object, + const size_t object_size, bool deep) { size_t off, fsize = 0, n; char *ptr, *dptr; @@ -719,7 +720,7 @@ bile_unmarshall_object(struct bile *bile, } else fsize = fields[n].size; - if (off + fsize > size) + if (off + fsize > data_size) panic("bile_unmarshall_object: overflow at field %lu of %lu!", n + 1, nfields); @@ -730,15 +731,21 @@ bile_unmarshall_object(struct bile *bile, memset(ptr, 0, sizeof(dptr)); continue; } - dptr = xmalloc(fsize); + dptr = xmalloc(fsize, "bile_unmarshall_object"); memcpy(ptr, &dptr, sizeof(dptr)); ptr = dptr; } if (fields[n].size < 0 && !deep) memset(ptr, 0, sizeof(dptr)); - else + else { + if (fields[n].size > 0 && + fields[n].struct_off + fsize > object_size) + panic("bile_unmarshall_object: overflow writing to object " + "at field %lu! (%lu > %lu)", n + 1, + fields[n].struct_off + fsize, object_size); memcpy(ptr, (char *)data + off, fsize); + } off += fsize; } @@ -895,7 +902,7 @@ bile_read_map(struct bile *bile, struct bile_object *m /* read entire map */ size = map_obj.size; - map = xmalloczero(size); + map = xmalloczero(size, "bile_read_map"); _bile_error = FSRead(bile->frefnum, &size, map); if (_bile_error) { xfree(&map); @@ -933,7 +940,7 @@ bile_write_map(struct bile *bile) new_map_size = BILE_OBJECT_SIZE * new_nobjects; new_map_obj = bile_alloc(bile, BILE_TYPE_MAP, new_map_id, new_map_size); - new_map = xcalloc(BILE_OBJECT_SIZE, new_nobjects); + new_map = xcalloc(BILE_OBJECT_SIZE, new_nobjects, "bile_write_map"); for (n = 0, new_nobjects = 0; n < bile->nobjects; n++) { obj = &bile->map[n]; --- bile.h Tue Jul 19 14:44:43 2022 +++ bile.h Mon Jul 25 15:07:34 2022 @@ -141,6 +141,7 @@ short bile_marshall_object(struct bile *bile, short bile_unmarshall_object(struct bile *bile, const struct bile_object_field *fields, const size_t nfields, const void *data, - const size_t size, void *object, bool deep); + const size_t data_size, void *object, + const size_t object_size, bool deep); #endif