Changeset 47

Timestamp:

06/30/08 17:33:55 (2 months ago)

Author:

jtang

Message:

Fixed error in sipc_send_data(), where a send of data with length 0 would cause undefined behavior.

Files:

• trunk/libsipc/man/man3/sipc_recv_data.3 (modified) (1 diff)
• trunk/libsipc/src/Makefile (modified) (1 diff)
• trunk/libsipc/src/sipc.c (modified) (2 diffs)
• trunk/libsipc/src/sipc_mqueue.c (modified) (6 diffs)
• trunk/libsipc/src/sipc_shm.c (modified) (2 diffs)
• trunk/libsipc/tests/Makefile (modified) (2 diffs)
• trunk/libsipc/tests/mqueue.c (modified) (2 diffs)

trunk/libsipc/man/man3/sipc_recv_data.3

@@ -24 +24 @@
-.TP
-.I len
-
+ (which could be 0).
-.PP
-If the IPC channel is a message queue, \fBsipc_recv_data\fR()

trunk/libsipc/src/Makefile

@@ -19 +19 @@
-        ln -sf $@ $(TARGET)
-
-
+ sipc_internal.h
-        $(CC) $(AM_CFLAGS) $(CFLAGS) $(INCLUDEDIRS) -c -o $@ $<
-

trunk/libsipc/src/sipc.c

@@ -152 +152 @@
-                return -1;
-        }
+        if (msg_len < 0) {
+                errno = EINVAL;
+                return -1;
+        }
+        if (sipc->role != SIPC_SENDER) {
+                sipc_error(sipc, "sipc_send_data called without sender flag enabled in IPC structure\n");
+                errno = EBADF;
+                return -1;
+        }
+        if (msg_len > sipc->data_size) {
+                sipc_error(sipc, "sipc_send_data: cannot send buffer of size %d, can only receive %zd\n", msg_len, sipc->data_size);
+                errno = ENOMEM;
+                return -1;
+        }
-
-        return sipc->funcs->sipc_send_data(sipc, msg_len);
@@ -158 +172 @@
-int sipc_recv_data(sipc_t *sipc, char **data, int *len)
-{
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-        return sipc->funcs->sipc_recv_data(sipc, data, len);

trunk/libsipc/src/sipc_mqueue.c

@@ -54 +54 @@
-static int mqueue_send_msg_len(sipc_t *sipc, int msg_len);
-static int mqueue_send_end_xmit(sipc_t *sipc);
-static char *split_data(sipc_t *sipc, size_t packet_sz);
-static int is_msg_len(struct msgbuf *mbuf);
-static int is_end_xmit(struct msgbuf *mbuf);
-static int msg_done(sipc_t *sipc);
-static size_t next_packet_sz(int recv, int max_packet_sz, int msg_len);
-static size_t next_alloc_sz(int recv, int recv_sz, int max_packet_sz, int msg_len);
-
@@ -142 +139 @@
-int sipc_mqueue_send_data(sipc_t *sipc, int msg_len)
-{
-int max_packet_sz = SIPC_MQUEUE_MSG_SZ - sizeof(struct msgbuf
+size_t max_packet_sz = SIPC_MQUEUE_MSG_SZ - sizeof(long
-        int error = 0;
-        size_t packet_sz;
-        char *packet = NULL;
-
-        if (!sipc) {
-                error = EINVAL;
-                goto err;
-        }
-        if (sipc->role != SIPC_SENDER) {
-                error = EINVAL;
-                goto err;
-        }
-
-        struct msgbuf *mbuf = sipc->mbuf;
-        assert(mbuf);
-        memset(mbuf, 0, SIPC_MQUEUE_MSG_SZ);
-        sipc->msg_len = msg_len;
-        if (mqueue_send_msg_len(sipc, msg_len) < 0) {
-                error = errno;
@@ -165 +150 @@
-        }
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
-                mbuf->mtype = SIPC_DATA_READY;
-packet, packet_sz
+sipc->data + amount_written, amount_to_write
-
-                /* Send the message */
-packet_sz
+amount_to_write
-                        error = errno;
-                        if (error != EINTR) {
@@ -187 +165 @@
-                        }
-                }
-free(packet)
- while (!msg_done(sipc));
+amount_written += amount_to_write
+
-
-        /* Send end of message marker */
@@ -195 +173 @@
-                goto err;
-        }
-        sipc->msg_len = SIPC_MSGLEN_NOT_SET;
-        return 0;
-
-      err:
-        free(packet);
-        sipc->msg_len = SIPC_MSGLEN_NOT_SET;
-        errno = error;
-        return -1;
@@ -434 +409 @@
-}
-
-/* Returns 1 if the message has been completely fragmented,
- * 0 otherwise. */
-static int msg_done(sipc_t *sipc)
-{
-        return sipc->copied >= sipc->msg_len ? 1 : 0;
-}
-
-/* Splits data in sipc into a chunk the size of the maximum
- * allowed for a message in a message queue.
- * This function allocates space for the fragmented piece of data.
- * The caller is responsible for freeign this memory. */
-static char *split_data(sipc_t *sipc, size_t packet_sz)
-{
-        size_t remaining = sipc->msg_len - sipc->copied;
-        size_t len = remaining > packet_sz ? packet_sz : remaining;
-        char *packet = calloc(1, len);
-        if (!packet)
-                return NULL;
-
-        memcpy(packet, (sipc->data) + (sipc->copied), len);
-        sipc->copied += len;
-
-        return packet;
-}
-
-/* Determine the next packet's size.
- * A packet should not contain extra padding.
- * Returns the size of the next packet on success, -1 on failure. */
-static size_t next_packet_sz(int recv, int max_packet_sz, int msg_len)
-{
-        if (recv < 0 || max_packet_sz <= 0 || msg_len <= 0)
-                return -1;
-
-        if (recv + max_packet_sz > msg_len)
-                return msg_len - recv;
-        else
-                return max_packet_sz;
-
-}
-
-/* Determine how much memory to allocate for receiving a packet.
- * A packet should not contain extra padding.

trunk/libsipc/src/sipc_shm.c

@@ -161 +161 @@
-{
-        int error;
-        if (!sipc) {
-                errno = EINVAL;
-                return -1;
-        }
-
-        /* Send a DATA_READY marker */
@@ -204 +200 @@
-        int block;
-
-        if (data)
-                *data = NULL;          /* Pointer to a buffer created here */
-        if (len)
-                *len = 0;              /* Bytes received so far */
-        if (!sipc || !data || !len) {
-                errno = EINVAL;
-                return -1;
-        }
-        block = (sipc->non_blocking == 0 ? 1 : 0);
-

trunk/libsipc/tests/Makefile

@@ -1 +1 @@
-TESTS = test_ipc ipc_creator ipc_destroyer
-
-
++
++
-TOP_BUILDDIR := $(shell pwd)/..
-
@@ -22 +22 @@
-        -rm -rf $(TESTS)
-
-
+s

trunk/libsipc/tests/mqueue.c

@@ -284 +284 @@
-                free(data);
-        }
+
+        CU_ASSERT(sipc_recv_data(reader_ipc, &data, &len) == 0);
+        CU_ASSERT_PTR_NOT_NULL(data);
+        CU_ASSERT(len == 0);
+        free(data);
-}
-
@@ -312 +317 @@
-        CU_ASSERT(send_end_xmit(writer_ipc) == 0);
-        fclose(ifile);
+
+        /* Trying sending a zero-byte message */
+        CU_ASSERT(sipc_send_data(writer_ipc, 0) == 0);
-
-        /* Cleanup handle here */