"String not null terminated" issues reported by static analysis in Stx-metal

Bug #1794937 reported by chen haochuan
272
This bug affects 1 person
Affects Status Importance Assigned to Milestone
StarlingX
Fix Released
High
chen haochuan

Bug Description

Title
-----
There is "String not null terminated" issue reported by static analysis in "stx-metal"

Brief Description
-----------------
stx/stx-metal/mtce/src/rmon/rmonMsg.cpp
function:
int rmon_service_inbox ( int clients )

line#525
bytes = recvfrom( rmon_sock.rmon_tx_sock, buf, RMON_MAX_LEN, 0, (struct sockaddr *)&rmon_sock.rmon_tx_addr, &len);
if ( bytes > 0 )
{
Comment:
in bytes > 0 branch, propose add buf[RMON_MAX_LEN-1] = '\0';

stx/stx-metal/mtce/src/public/amon.c
function:
int active_monitor_dispatch ( void )

line#212
rc = recvfrom ( amon.rx_sock, amon.rx_buf, AMON_MAX_LEN, 0,
                (struct sockaddr *)&amon.rx_addr, &len);
propose add amon.rx_buf[AMON_MAX_LEN-1] = '\0'

stx/stx-metal/mtce/src/maintenance/mtcCtrlMsg.cpp
function:
int mtc_service_inbox ( nodeLinkClass * obj_ptr,
                        mtc_socket_type * sock_ptr,
                        int iface)
line#130 --- line#145
if ( iface == INFRA_INTERFACE )
{
    if ( ( obj_ptr ) &&
         ( obj_ptr->infra_network_provisioned == true ) &&
         ( sock_ptr->mtc_agent_infra_rx_socket ))
    {
        bytes = sock_ptr->mtc_agent_infra_rx_socket->read((char*)&msg, sizeof(msg));
    }
    else
    {
        return ( FAIL_NO_INFRA_PROV );
    }
}
else
{
    bytes = sock_ptr->mtc_agent_rx_socket->read((char*)&msg, sizeof(msg));
}

add msg.buf[BUF_SIZE-1] = '\0'

stx/stx-metal/mtce/src/hwmon/hwmonMsg.cpp

int hwmon_service_inbox ( void )

line#227 --- line#230
memset ((void*)&msg,0,sizeof(mtc_message_type));
bytes = hwmon_sock.cmd_sock->read((char*)&msg.hdr[0], sizeof(mtc_message_type));
if( bytes <= 0 )
{
    if ( ( errno == EINTR ) || ( errno == EAGAIN ))
    {
        return (RETRY);
    }
    else
    {
        elog ("receive error (%d:%s)\n", errno , strerror (errno));
        return (FAIL_TO_RECEIVE);
    }
}

msg.buf[BUF_SIZE-1] = '\0'

stx/stx-metal/mtce/src/hostw/hostwHdlr.cpp

int hostw_service_command ( hostw_socket_type * hostw_socket)

line#175 --- line#180
mtc_message_type msg[2]; /* we use a chunk of memory larger than a single
                          * mtc_message_type to check for oversized messages
                          * (invalid...)
                          */
int len = sizeof(msg[0]) + 1;

add
memset(&msg, 0, 2*sizeof(msg[0]));

Severity
--------
Critical: there is possibility of string malfunction
Steps to Reproduce
------------------
Run code static analysis tool

Expected Behavior
------------------
no risk of string malfunction

Reproducibility
---------------
Always

System Configuration
--------------------
All case

Revision history for this message
chen haochuan (martin1982) wrote :
tags: added: stx.security
information type: Public → Private
information type: Private → Private Security
Changed in starlingx:
status: New → In Progress
Ken Young (kenyis)
Changed in starlingx:
importance: Undecided → High
assignee: nobody → Cindy Xie (xxie1)
haitao wang (hwang85)
Changed in starlingx:
assignee: Cindy Xie (xxie1) → haitao wang (hwang85)
description: updated
Changed in starlingx:
assignee: haitao wang (hwang85) → chen haochuan (martin1982)
Changed in starlingx:
status: In Progress → Fix Committed
status: Fix Committed → Fix Released
Ken Young (kenyis)
tags: added: stx.2019.03
Revision history for this message
haitao wang (hwang85) wrote :
Ken Young (kenyis)
information type: Private Security → Public Security
Ken Young (kenyis)
tags: added: stx.2019.05
removed: stx.2019.03
Ken Young (kenyis)
tags: added: stx.2.0
removed: stx.2019.05
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.