Skip to content

Commit

Permalink
Reduce the type assumption on credential types while deserializing
Browse files Browse the repository at this point in the history
Despite using proper types for uid/gid, the deserialization was still
assuming uint32_t.  This patch uses the OS's type (assuming it's 32 bits
long.)  This also removes the sketchy reinterpret_cast.

Signed-off-by: Matthew Russell <matthew.g.russell@gmail.com>
  • Loading branch information
kheaactua committed Jun 14, 2024
1 parent 820ad66 commit ecd2ee4
Showing 1 changed file with 8 additions and 7 deletions.
15 changes: 8 additions & 7 deletions implementation/security/src/policy.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -38,15 +38,16 @@ bool
policy::deserialize_uid_gid(const byte_t * &_data, uint32_t &_size,
uid_t &_uid, gid_t &_gid) const {

bool its_result;

its_result = deserialize_u32(_data, _size, reinterpret_cast<uint32_t&>(_uid));
if (its_result == false)
if (_size < sizeof(uid_t))
return false;

its_result = deserialize_u32(_data, _size, reinterpret_cast<uint32_t&>(_gid));
if (its_result == false)
return false;
_uid = VSOMEIP_BYTES_TO_LONG(_data[0], _data[1], _data[2], _data[3]);
_data += sizeof(uid_t);
_size -= static_cast<uid_t>(sizeof(uid_t));

_gid = VSOMEIP_BYTES_TO_LONG(_data[0], _data[1], _data[2], _data[3]);
_data += sizeof(gid_t);
_size -= static_cast<uid_t>(sizeof(gid_t));

return true;
}
Expand Down

0 comments on commit ecd2ee4

Please sign in to comment.