Add checking errors returned by CPName_GetComponent.

CPName_GetComponent returns either length of the name or -1
in case of errors. Need to check for -1 everywhere before using
the result of this function. Need to make sure that returned value is
assigned to a signed variable otherwise error condition is lost.

Signed-off-by: Marcelo Vanzin <mvanzin@vmware.com>

diff --git a/open-vm-tools/lib/dnd/dndCommon.c b/open-vm-tools/lib/dnd/dndCommon.c
index 9ee37d71eb8849bce2bd8121c7eb43f601963745..4d543d24411fa35cec1386128819c02f5f27c708 100644 (file)
--- a/open-vm-tools/lib/dnd/dndCommon.c
+++ b/open-vm-tools/lib/dnd/dndCommon.c
@@ -367,7 +367,10 @@ DnDPrependFileRoot(ConstUnicode fileRoot,  // IN    : file root to append
        */
 
       escapedLen = HgfsEscape_GetSize(begin, len);
-      if (0 == escapedLen) {
+      if (escapedLen < 0) {
+         Log("%s: error calculating buffer size\n", __FUNCTION__);
+         return FALSE;
+      } else if (0 == escapedLen) {
          newDataLen += rootLen + len + 1;
          newData = (char *)Util_SafeRealloc(newData, newDataLen);
 

diff --git a/open-vm-tools/lib/hgfs/cpName.c b/open-vm-tools/lib/hgfs/cpName.c
index 58da546ab7dcf228f9d3574aca5599fad9b94a54..d3ac795dac633281aeec6c48abe247dca0e362c3 100644 (file)
--- a/open-vm-tools/lib/hgfs/cpName.c
+++ b/open-vm-tools/lib/hgfs/cpName.c
@@ -101,8 +101,13 @@ CPName_GetComponent(char const *begin,   // IN: Beginning of buffer
          }
 
          myNext = walk + 1;
+         /* Skip consecutive path delimiters. */
+         while ((*myNext == '\0') && (myNext != end)) {
+            myNext++;
+         }
          if (myNext == end) {
             /* Last character in the buffer is not allowed to be NUL */
+            Log("%s: error: last char can't be NUL\n", __FUNCTION__);
             return -1;
          }
 
@@ -149,9 +154,11 @@ CPNameEscapeAndConvertFrom(char const **bufIn, // IN/OUT: Input to convert
                            char pathSep)       // IN: Path separator character
 {
    int result;
-   size_t inputSize;
+   int inputSize;
    inputSize = HgfsEscape_GetSize(*bufIn, *inSize);
-   if (inputSize != 0) {
+   if (inputSize < 0) {
+      result = -1;
+   } else if (inputSize != 0) {
       char *savedBufOut = *bufOut;
       char const *savedOutConst = savedBufOut;
       size_t savedOutSize = *outSize;
@@ -429,9 +436,21 @@ CPNameConvertTo(char const *nameIn, // IN:  Buf to convert
       nameIn++;
    }
 
-    /* Copy the string to the output buf, converting all path separators into '\0'. */
-   for (; *nameIn != '\0' && bufOut < endOut; nameIn++) {
-      *bufOut = (*nameIn == pathSep) ? '\0' : *nameIn;
+    /*
+     * Copy the string to the output buf, converting all path separators into '\0'.
+     * Collapse multiple consecutive path separators into a single one since
+     * CPName_GetComponent can't handle consecutive path separators.
+     */
+   while (*nameIn != '\0' && bufOut < endOut) {
+      if (*nameIn == pathSep) {
+         *bufOut = '\0';
+         do {
+            nameIn++;
+         } while (*nameIn == pathSep);
+      } else {
+         *bufOut = *nameIn;
+         nameIn++;
+      }
       bufOut++;
    }
 

diff --git a/open-vm-tools/lib/hgfs/hgfsEscape.c b/open-vm-tools/lib/hgfs/hgfsEscape.c
index ddafb053d089c4871b13f3b3e2cdb3fb0c9ae007..518b27f7864d63e257c1cd4f2b7d16001b941656 100644 (file)
--- a/open-vm-tools/lib/hgfs/hgfsEscape.c
+++ b/open-vm-tools/lib/hgfs/hgfsEscape.c
@@ -718,7 +718,10 @@ HgfsEscape_Do(char const *bufIn, // IN:  Buffer with unescaped input
    }
    while (currentComponent - bufIn < sizeIn) {
       int escapedLength;
-      uint32 componentSize = CPName_GetComponent(currentComponent, end, &next);
+      int componentSize = CPName_GetComponent(currentComponent, end, &next);
+      if (componentSize < 0) {
+         return componentSize;
+      }
 
       escapedLength = HgfsEscapeDoComponent(currentComponent, componentSize,
                                             sizeLeft, outPointer);
@@ -778,7 +781,11 @@ HgfsEscape_GetSize(char const *bufIn,    // IN:  Buffer with unescaped input
       currentComponent++;
    }
    while (currentComponent - bufIn < sizeIn) {
-      uint32 componentSize = CPName_GetComponent(currentComponent, end, &next);
+      int componentSize = CPName_GetComponent(currentComponent, end, &next);
+      if (componentSize < 0) {
+         Log("%s: failed to calculate escapde name size - name is invalid\n", __FUNCTION__);
+         return -1;
+      }
       result += HgfsEscapeGetComponentSize(currentComponent, componentSize);
       currentComponent = next;
    }

diff --git a/open-vm-tools/lib/hgfsServer/hgfsServer.c b/open-vm-tools/lib/hgfsServer/hgfsServer.c
index 2ac021edc09dc802cca429f46ca78e167344dca5..eca7852472b295a7458df9fee887bcd41e7f1ac3 100644 (file)
--- a/open-vm-tools/lib/hgfsServer/hgfsServer.c
+++ b/open-vm-tools/lib/hgfsServer/hgfsServer.c
@@ -1199,7 +1199,7 @@ HgfsServerCheckOpenFlagsForShare(HgfsFileOpenInfo *openInfo,// IN: Hgfs file han
    HgfsOpenMode shareMode;
    char const *inEnd;
    char const *next;
-   uint32 len;
+   int len;
 
    ASSERT(openInfo);
    ASSERT(flags);