Skip to content

Commit

Permalink
Reduce the type assumption on credential types while deserializing
Browse files Browse the repository at this point in the history
Despite using proper types for uid/gid, the deserialization was still
assuming uint32_t.  This patch uses the OS's type (assuming it's 32 bits
long.)  This also removes the sketchy reinterpret_cast.
  • Loading branch information
kheaactua committed Jan 9, 2024
1 parent 263fd78 commit 59a227e
Showing 1 changed file with 8 additions and 7 deletions.
15 changes: 8 additions & 7 deletions implementation/security/src/policy.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -38,15 +38,16 @@ bool
policy::deserialize_uid_gid(const byte_t * &_data, uint32_t &_size,
uid_t &_uid, gid_t &_gid) const {

bool its_result;

its_result = deserialize_u32(_data, _size, reinterpret_cast<uint32_t&>(_uid));
if (its_result == false)
if (_size < sizeof(uid_t))
return false;

its_result = deserialize_u32(_data, _size, reinterpret_cast<uint32_t&>(_gid));
if (its_result == false)
return false;
_uid = VSOMEIP_BYTES_TO_LONG(_data[0], _data[1], _data[2], _data[3]);
_data += sizeof(uid_t);
_size -= static_cast<uid_t>(sizeof(uid_t));

_gid = VSOMEIP_BYTES_TO_LONG(_data[0], _data[1], _data[2], _data[3]);
_data += sizeof(gid_t);
_size -= static_cast<uid_t>(sizeof(gid_t));

return true;
}
Expand Down

0 comments on commit 59a227e

Please sign in to comment.