rxgen: Check maximum length of parameter string or opaque

Check the maximum length of string or opaque parameter to a function and raise
an exception if it is too long.

Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/py_rxgen.c b/py_rxgen.c
index 6c90004c2072e75529a626705cb8913906ea0cc9..7d88746b977b58c6eba0c22993fc7cb0f383eccf 100644 (file)
--- a/py_rxgen.c
+++ b/py_rxgen.c
@@ -828,7 +828,7 @@ static int py_enc_pil_array(struct rx_call *call,
 /*
  * Encode the contents of a python buffer view.
  */
-int py_enc_buffer(struct rx_call *call, Py_buffer *view)
+int py_enc_buffer(struct rx_call *call, Py_buffer *view, size_t dim)
 {
        int i;
 
@@ -843,6 +843,11 @@ int py_enc_buffer(struct rx_call *call, Py_buffer *view)
                printf(" }\n");
        }
 
+       if (view->len > dim) {
+               PyErr_Format(PyExc_RuntimeError, "Marshalling Error: String or opaque value too long");
+               return -1;
+       }
+
        rxrpc_enc(call, view->len);
 
        if (view->ndim == 0 || (view->ndim == 1 && !view->shape)) {

diff --git a/py_rxgen.h b/py_rxgen.h
index 3ffce61191d69a2eee72924c5907c08f66dc8da2..90f4aee3412b22ebd70926b1030b9217213f23fb 100644 (file)
--- a/py_rxgen.h
+++ b/py_rxgen.h
@@ -53,7 +53,7 @@ extern int py_rxgen_premarshal_struct(void *p, size_t size, size_t offs,
  */
 extern PyObject *py_rxgen_get_string(const void *_p, size_t n);
 extern int py_rxgen_set_string(void *_p, size_t n, PyObject *val);
-extern int py_enc_buffer(struct rx_call *call, Py_buffer *view);
+extern int py_enc_buffer(struct rx_call *call, Py_buffer *view, size_t dim);
 extern void py_dec_string(struct rx_call *call);
 extern int py_dec_opaque(struct rx_call *call, PyObject *obj);
 

diff --git a/rxgen/emit_py_sync_funcs.pm b/rxgen/emit_py_sync_funcs.pm
index 6a95b0bd64b911d3956a6f0b41d265bb9bc78437..76f104fc89bac78daae361c15e9cb22101040e84 100644 (file)
--- a/rxgen/emit_py_sync_funcs.pm
+++ b/rxgen/emit_py_sync_funcs.pm
@@ -340,7 +340,9 @@ sub emit_py_func_simple_sync_call($)
            print PYOUT "\t\tgoto error;\n";
        } elsif ($p->{class} eq "bulk" && ($p->{elem}->{class} eq "string" ||
                                           $p->{elem}->{class} eq "opaque")) {
-           print PYOUT "\tif (py_enc_buffer(call, &param_", $p->{name}, ") < 0) {\n";
+           my $dim = -1;
+           $dim = $p->{dim} if exists $p->{dim};
+           print PYOUT "\tif (py_enc_buffer(call, &param_", $p->{name}, ", ", $dim, ") < 0) {\n";
            print PYOUT "\t\trxrpc_terminate_call(call, EINVAL);\n";
            print PYOUT "\t\treturn NULL;\n";
            print PYOUT "\t}\n";