From: VMware, Inc <>
Date: Thu, 15 Oct 2009 21:09:34 +0000 (-0700)
Subject: Add checking errors returned by CPName_GetComponent.
X-Git-Tag: 2009.10.15-201664~20
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=55e9a285a8fcaabf0e11373fc29ea6b83bd51abd;p=thirdparty%2Fopen-vm-tools.git

Add checking errors returned by CPName_GetComponent.

CPName_GetComponent returns either length of the name or -1
in case of errors. Need to check for -1 everywhere before using
the result of this function. Need to make sure that returned value is
assigned to a signed variable otherwise error condition is lost.

Signed-off-by: Marcelo Vanzin <mvanzin@vmware.com>
---

diff --git a/open-vm-tools/lib/dnd/dndCommon.c b/open-vm-tools/lib/dnd/dndCommon.c
index 9ee37d71e..4d543d244 100644
--- a/open-vm-tools/lib/dnd/dndCommon.c
+++ b/open-vm-tools/lib/dnd/dndCommon.c
@@ -367,7 +367,10 @@ DnDPrependFileRoot(ConstUnicode fileRoot,  // IN    : file root to append
        */
 
       escapedLen = HgfsEscape_GetSize(begin, len);
-      if (0 == escapedLen) {
+      if (escapedLen < 0) {
+         Log("%s: error calculating buffer size\n", __FUNCTION__);
+         return FALSE;
+      } else if (0 == escapedLen) {
          newDataLen += rootLen + len + 1;
          newData = (char *)Util_SafeRealloc(newData, newDataLen);
 
diff --git a/open-vm-tools/lib/hgfs/cpName.c b/open-vm-tools/lib/hgfs/cpName.c
index 58da546ab..d3ac795da 100644
--- a/open-vm-tools/lib/hgfs/cpName.c
+++ b/open-vm-tools/lib/hgfs/cpName.c
@@ -101,8 +101,13 @@ CPName_GetComponent(char const *begin,   // IN: Beginning of buffer
          }
 
          myNext = walk + 1;
+         /* Skip consecutive path delimiters. */
+         while ((*myNext == '\0') && (myNext != end)) {
+            myNext++;
+         }
          if (myNext == end) {
             /* Last character in the buffer is not allowed to be NUL */
+            Log("%s: error: last char can't be NUL\n", __FUNCTION__);
             return -1;
          }
 
@@ -149,9 +154,11 @@ CPNameEscapeAndConvertFrom(char const **bufIn, // IN/OUT: Input to convert
                            char pathSep)       // IN: Path separator character
 {
    int result;
-   size_t inputSize;
+   int inputSize;
    inputSize = HgfsEscape_GetSize(*bufIn, *inSize);
-   if (inputSize != 0) {
+   if (inputSize < 0) {
+      result = -1;
+   } else if (inputSize != 0) {
       char *savedBufOut = *bufOut;
       char const *savedOutConst = savedBufOut;
       size_t savedOutSize = *outSize;
@@ -429,9 +436,21 @@ CPNameConvertTo(char const *nameIn, // IN:  Buf to convert
       nameIn++;
    }
 
-    /* Copy the string to the output buf, converting all path separators into '\0'. */
-   for (; *nameIn != '\0' && bufOut < endOut; nameIn++) {
-      *bufOut = (*nameIn == pathSep) ? '\0' : *nameIn;
+    /*
+     * Copy the string to the output buf, converting all path separators into '\0'.
+     * Collapse multiple consecutive path separators into a single one since
+     * CPName_GetComponent can't handle consecutive path separators.
+     */
+   while (*nameIn != '\0' && bufOut < endOut) {
+      if (*nameIn == pathSep) {
+         *bufOut = '\0';
+         do {
+            nameIn++;
+         } while (*nameIn == pathSep);
+      } else {
+         *bufOut = *nameIn;
+         nameIn++;
+      }
       bufOut++;
    }
 
diff --git a/open-vm-tools/lib/hgfs/hgfsEscape.c b/open-vm-tools/lib/hgfs/hgfsEscape.c
index ddafb053d..518b27f78 100644
--- a/open-vm-tools/lib/hgfs/hgfsEscape.c
+++ b/open-vm-tools/lib/hgfs/hgfsEscape.c
@@ -718,7 +718,10 @@ HgfsEscape_Do(char const *bufIn, // IN:  Buffer with unescaped input
    }
    while (currentComponent - bufIn < sizeIn) {
       int escapedLength;
-      uint32 componentSize = CPName_GetComponent(currentComponent, end, &next);
+      int componentSize = CPName_GetComponent(currentComponent, end, &next);
+      if (componentSize < 0) {
+         return componentSize;
+      }
 
       escapedLength = HgfsEscapeDoComponent(currentComponent, componentSize,
                                             sizeLeft, outPointer);
@@ -778,7 +781,11 @@ HgfsEscape_GetSize(char const *bufIn,    // IN:  Buffer with unescaped input
       currentComponent++;
    }
    while (currentComponent - bufIn < sizeIn) {
-      uint32 componentSize = CPName_GetComponent(currentComponent, end, &next);
+      int componentSize = CPName_GetComponent(currentComponent, end, &next);
+      if (componentSize < 0) {
+         Log("%s: failed to calculate escapde name size - name is invalid\n", __FUNCTION__);
+         return -1;
+      }
       result += HgfsEscapeGetComponentSize(currentComponent, componentSize);
       currentComponent = next;
    }
diff --git a/open-vm-tools/lib/hgfsServer/hgfsServer.c b/open-vm-tools/lib/hgfsServer/hgfsServer.c
index 2ac021edc..eca785247 100644
--- a/open-vm-tools/lib/hgfsServer/hgfsServer.c
+++ b/open-vm-tools/lib/hgfsServer/hgfsServer.c
@@ -1199,7 +1199,7 @@ HgfsServerCheckOpenFlagsForShare(HgfsFileOpenInfo *openInfo,// IN: Hgfs file han
    HgfsOpenMode shareMode;
    char const *inEnd;
    char const *next;
-   uint32 len;
+   int len;
 
    ASSERT(openInfo);
    ASSERT(flags);