Changeset 5145:c1a3ca765154 in roaraudio for libroar/ltm.c

Timestamp:

10/11/11 13:47:59 (13 years ago)

Author:

phi

Branch:

default

Phase:

public

Message:

• Fixed invalid pointer aliasing in filter code (pr0)
• Fixed remote a local buffer overflow in client to message converter code as well as a remote attackable overflow in message to client converter code (pr0)
• Updated error handling (pr0)

File:

• libroar/ltm.c (modified) (6 diffs)

libroar/ltm.c

@@ -65 +65 @@
  size_t i;
 
- if ( mt == 0 || streams == NULL || slen == 0 || mes == NULL || buf == NULL ) {
+ if ( mt == 0 ) {
   roar_err_set(ROAR_ERROR_INVAL);
+  return -1;
+ }
+
+ if ( streams == NULL || slen == 0 || mes == NULL || buf == NULL ) {
+  roar_err_set(ROAR_ERROR_FAULT);
   return -1;
  }
@@ -172 +177 @@
  int    i;
 
- if ( con == NULL )
-  return NULL;
-
- if ( streams == NULL || slen == 0 )
-  return NULL;
+ if ( con == NULL ) {
+  roar_err_set(ROAR_ERROR_FAULT);
+  return NULL;
+ }
+
+ if ( streams == NULL || slen == 0 ) {
+  roar_err_set(ROAR_ERROR_FAULT);
+  return NULL;
+ }
 
  if ( roar_ltm_pack_req(mt, window, streams, slen, &mes, &buf, ROAR_LTM_SST_GET_RAW) == -1 )
@@ -238 +247 @@
 }
 
-#define _CKNULL(x) if ( (x) == NULL ) return -1
-#define _RETMEMBERCKED(x,m) _CKNULL(x); return (x)->m
+#define _CKNULL(x) if ( (x) == NULL ) { roar_err_set(ROAR_ERROR_FAULT); return -1; }
+#define _RETMEMBERCKED(x,m) _CKNULL(x) return (x)->m
 
 int roar_ltm_get_numstreams(struct roar_ltm_result * res) {
@@ -258 +267 @@
  ROAR_DBG("roar_ltm_get_streamptr(res=%p, streamidx=%i) = ?", res, streamidx);
 
- if ( res == NULL || streamidx < 0 || streamidx >= res->streams )
-  return NULL;
+ if ( res == NULL || streamidx < 0 || streamidx >= res->streams ) {
+  roar_err_set(ROAR_ERROR_FAULT);
+  return NULL;
+ }
 
  ptr = res->data;
@@ -294 +305 @@
  ROAR_DBG("roar_ltm_extract(res=%p, mt=0x%.4x, streamidx=%i, channel=%i) = ?", res, mt, streamidx, channel);
 
- if ( roar_ltm_numbits(mt) != 1 )
-  return -1;
+ if ( roar_ltm_numbits(mt) != 1 ) {
+  roar_err_set(ROAR_ERROR_INVAL);
+  return -1;
+ }
 
  ROAR_DBG("roar_ltm_extract(res=%p, mt=0x%.4x, streamidx=%i, channel=%i) = ?", res, mt, streamidx, channel);
@@ -306 +319 @@
  ROAR_DBG("roar_ltm_extract(res=%p, mt=0x%.4x, streamidx=%i, channel=%i): numchans=%i", res, mt, streamidx, channel, numchans);
 
- if ( channel >= numchans )
-  return -1;
+ if ( channel >= numchans ) {
+  roar_err_set(ROAR_ERROR_RANGE);
+  return -1;
+ }
 
  ptr++;