commit bdf061e863c3eba35d9bd07bf606c05dc0697400
author qctecmdr <qctecmdr@localhost> Fri Aug 12 10:53:59 2022 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Fri Aug 12 10:53:59 2022 -0700
tree 7f70263a63b28d3c9f1fe6626ce4d2c0525cc0b8
parent 5a77aa5968eb5ba2f1e92d09810ac8cadc613513
parent 700be69792c27ce5ce27f6815b3569ae24c065cb

Merge "service: metadata: Add checks for heap overflow"

service/src/metadata.c

diff --git a/service/src/metadata.c b/service/src/metadata.c
index 87c0677..c94f856 100644
--- a/service/src/metadata.c
+++ b/service/src/metadata.c
@@ -71,6 +71,8 @@
 #define NUM_PROPS(x)                    *((uint32_t *) PTR_TO_NUM_PROPS(x))
 #define PTR_TO_PROPS(x)                 (PTR_TO_NUM_PROPS(x) + sizeof(uint32_t))
 
+#define MAX_KVPAIR 48
+
 void metadata_print(struct agm_meta_data_gsl* metadata)
 {
     int i, count = metadata->gkv.num_kvs;
@@ -201,6 +203,13 @@
     }
     va_end(valist);
 
+    if ((merged->gkv.num_kvs > MAX_KVPAIR) || (merged->ckv.num_kvs > MAX_KVPAIR)) {
+        AGM_LOGE("Num GKVs %d Num CKVs %d more than expected: %d", merged->gkv.num_kvs,
+                                                      merged->ckv.num_kvs, MAX_KVPAIR);
+        free(merged);
+        return NULL;
+    }
+
     merged->gkv.kv = calloc(merged->gkv.num_kvs, sizeof(struct agm_key_value));
     if (!merged->gkv.kv) {
         AGM_LOGE("No memory to merge gkv\n");
@@ -271,6 +280,14 @@
         AGM_LOGI("NULL metadata passed, ignoring\n");
         return ret;
     }
+
+    if ((NUM_GKV(metadata) > MAX_KVPAIR) || (NUM_CKV(metadata) > MAX_KVPAIR)) {
+        AGM_LOGE("Num GKVs %d Num CKVs %d more than expected: %d", NUM_GKV(metadata),
+                                                      NUM_CKV(metadata), MAX_KVPAIR);
+        ret = -EINVAL;
+        return ret;
+    }
+
     dest->gkv.num_kvs = NUM_GKV(metadata);
     dest->gkv.kv =  calloc(dest->gkv.num_kvs, sizeof(struct agm_key_value));
     if (!dest->gkv.kv) {