Skip to content
This repository was archived by the owner on Sep 12, 2024. It is now read-only.

Commit 1a6bc96

Browse files
kkarmakarMSkkarmakarMS
authored
Bug fixes for scanned items 7 (#882)
* Fix codeql issue * Fix for codeql issues * Fix for the addition * Adding extra log * Fixing scan items * CodeQL fixes * Fix for CodeQL issues
1 parent 3129204 commit 1a6bc96

File tree

13 files changed

+62
-24
lines changed

13 files changed

+62
-24
lines changed

‎LCM/codec/mof/mofserializer.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1824,7 +1824,6 @@ MI_Result MI_MAIN_CALL MI_Application_NewSerializer_Mof(
18241824
{
18251825
ExtFunctionTable* eft =
18261826
(ExtFunctionTable*)PAL_Malloc(sizeof(ExtFunctionTable));
1827-
memset(eft, 0, sizeof(ExtFunctionTable));
18281827

18291828
if (!eft)
18301829
return MI_RESULT_FAILED;

‎LCM/dsc/engine/ConfigurationManager/LocalConfigManagerHelper.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5993,7 +5993,7 @@ MI_Result LCM_Pull_ExecuteActionPerConfiguration(
59935993
MI_Char* assignedConfig = NULL;
59945994

59955995
// MI_Char* status = ((*serverAssignedConfigurations)->Details)->Status;
5996-
if (serverAssignedConfigurations != NULL && *serverAssignedConfigurations != NULL && ((*serverAssignedConfigurations)->Details) != NULL)
5996+
if (*serverAssignedConfigurations != NULL && ((*serverAssignedConfigurations)->Details) != NULL)
59975997
{
59985998
assignedConfig = ((*serverAssignedConfigurations)->Details)->ConfigurationName;
59995999
}
@@ -6779,7 +6779,7 @@ MI_Result CallPerformInventory(
67796779
InMOF = GetInventoryFileName();
67806780
}
67816781

6782-
if (File_ExistT(InMOF) != 0)
6782+
if (File_ExistT(InMOF) != 0) // CodeQL [cpp/path-injection] Safe Path: Currently only known paths are considered
67836783
{
67846784
SetLCMStatusReady();
67856785
return GetCimMIError(MI_RESULT_FAILED, cimErrorDetails, ID_LCMHELPER_INVENTORY_MOF_DOESNT_EXIST);

‎LCM/dsc/engine/ConfigurationManager/OMI_LocalConfigManagerHelper.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,8 @@ MI_Result UpdateTask(
112112
while (cronFile != NULL && (read = readline(&line, &readLength, cronFile)) != -1)
113113
{
114114
retValue = TcsStrlcpy(lineToWrite, line, Tcslen(line)+1);
115-
//Assuming last wildcard of the cron expression is not more than 10 characters
116-
retValue = sscanf(line, MI_T("%*s %*s %*s %*s %*s %*s %10s"), taskInCrontab);
115+
//Assuming size will be not more than 256 which is the value of UNIT_LINE_SIZE
116+
retValue = sscanf(line, MI_T("%*s %*s %*s %*s %*s %*s %256s"), taskInCrontab);
117117
if (retValue == 0)
118118
{
119119
// Ignore the bad line that does not comply with crontab file format

‎LCM/dsc/engine/EngineHelper/EventWrapper.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,10 @@ void DSCFileVPutTelemetry(
130130

131131
if (json_value_get_type(telemetry_root_value) != JSONObject) {
132132
telemetry_root_value = json_value_init_object();
133+
if(telemetry_root_value == NULL) {
134+
printf("Failed to parse JSON from OMS Config Host Telemetry Path");
135+
return;
136+
}
133137
}
134138

135139
JSON_Object *telemetry_root_object = json_value_get_object(telemetry_root_value);
@@ -217,6 +221,10 @@ void DSCFilePutTelemetry(
217221

218222
if (json_value_get_type(telemetry_root_value) != JSONObject) {
219223
telemetry_root_value = json_value_init_object();
224+
if(telemetry_root_value == NULL) {
225+
printf("Failed to parse JSON from OMS Config Host Telemetry Path");
226+
return;
227+
}
220228
}
221229

222230
JSON_Object *telemetry_root_object = json_value_get_object(telemetry_root_value);

‎LCM/dsc/engine/EngineHelper/PAL_Extension.c

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -195,10 +195,7 @@ int File_CopyT(_In_z_ const PAL_Char* src, _In_z_ const PAL_Char* dest)
195195
#ifndef CONFIG_ENABLE_WCHAR
196196

197197
/* Unlink output file if it exists */
198-
if (access(dest, F_OK) == 0)
199-
{
200-
unlink(dest);
201-
}
198+
remove(dest);
202199
#endif
203200
#endif
204201

‎LCM/dsc/engine/ca/CAInfrastructure/CAEngine.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2108,7 +2108,7 @@ MI_Result PerformInventoryMethodResult(_In_ MI_Operation *operation,
21082108
MI_Instance * tempInstance;
21092109
MI_Instance ** outInstanceArray;
21102110
MI_Boolean moreResults;
2111-
MI_Result result;
2111+
MI_Result result = MI_RESULT_INVALID_PARAMETER;
21122112
const MI_Char *errorMessage;
21132113
const MI_Instance *completionDetails = NULL;
21142114
MI_Value value;

‎LCM/dsc/engine/ca/CAInfrastructure/WebPullClient.c

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -331,9 +331,20 @@ static size_t WriteCallback(void *contents, size_t size, size_t nmemb, void *use
331331
if( nmemb != 0 && (realsize / nmemb != size || (realsize % nmemb) != 0)) {
332332
return 0;
333333
}
334+
size_t reallocationSize = realsize;
335+
//Handle size overflow due to addition
336+
if(reallocationSize + 1 < reallocationSize) {
337+
return 0;
338+
}
339+
reallocationSize = reallocationSize + 1;
334340
struct Chunk *mem = (struct Chunk *)userp;
341+
//Handle size overflow due to addition
342+
if(reallocationSize + mem->size < reallocationSize || reallocationSize + mem->size < mem->size) {
343+
return 0;
344+
}
345+
reallocationSize = reallocationSize + mem->size;
335346

336-
char* tempMemData = (char *)realloc(mem->data, mem->size + realsize + 1);
347+
char* tempMemData = (char *)realloc(mem->data, reallocationSize);
337348
if(tempMemData == NULL) {
338349
free(mem->data);
339350
return 0;

‎LCM/dsc/engine/dsc_host/dsc_host.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -228,12 +228,13 @@ int main(int argc, char *argv[])
228228
}
229229

230230
DSC_TELEMETRY_INFO("dsc_host starting operation '%s'", argv[2]);
231+
DSC_TELEMETRY_INFO("dsc_host configuration '%s'", argv[3]);
231232
switch(current_operation)
232233
{
233234
case DscSupportedOperation_GetConfiguration:
234235
{
235236
operation_name = DSC_OPERATION_GET_CONFIGURATION_STR;
236-
result = DscLib_GetConfiguration (&operation_result_root_value, argv[3], &operation_error_root_value);
237+
result = DscLib_GetConfiguration (&operation_result_root_value, argv[3], &operation_error_root_value); // CodeQL [cpp/path-injection] Safe Path: Currently only known paths are considered
237238
break;
238239
}
239240
case DscSupportedOperation_TestConfiguration:
@@ -258,20 +259,20 @@ int main(int argc, char *argv[])
258259
{
259260
operation_name = DSC_OPERATION_SEND_CONFIGURATION_STR;
260261
MI_Boolean force = (Tcscasecmp(argv[4], MI_T("force")) == 0) ? MI_TRUE : MI_FALSE;
261-
result = DscLib_SendConfiguration (argv[3], force, &operation_error_root_value);
262+
result = DscLib_SendConfiguration (argv[3], force, &operation_error_root_value); // CodeQL [cpp/path-injection] Safe Path: Currently only known paths are considered
262263
break;
263264
}
264265
case DscSupportedOperation_SendConfigurationApply:
265266
{
266267
operation_name = DSC_OPERATION_SEND_CONFIGURATION_APPLY_STR;
267268
MI_Boolean force = (Tcscasecmp(argv[4], MI_T("force")) == 0) ? MI_TRUE : MI_FALSE;
268-
result = DscLib_SendConfigurationApply (argv[3], force, &operation_error_root_value);
269+
result = DscLib_SendConfigurationApply (argv[3], force, &operation_error_root_value); // CodeQL [cpp/path-injection] Safe Path: Currently only known paths are considered
269270
break;
270271
}
271272
case DscSupportedOperation_SendMetaConfigurationApply:
272273
{
273274
operation_name = DSC_OPERATION_SEND_METACONFIGURATION_APPLY_STR;
274-
result = DscLib_SendMetaConfigurationApply (argv[3], &operation_error_root_value);
275+
result = DscLib_SendMetaConfigurationApply (argv[3], &operation_error_root_value); // CodeQL [cpp/path-injection] Safe Path: Currently only known paths are considered
275276
break;
276277
}
277278
case DscSupportedOperation_GetMetaConfiguration:

‎Providers/nxFileInventory/MSFT_nxFileInventoryResource.cpp

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,11 +225,16 @@ void MI_CALL MSFT_nxFileInventoryResource_Invoke_InventoryTargetResource(
225225
const char * reportTemplateBase = DSC_ETC_PATH "/InventoryReports/nxFileInventory_XXXXXX";
226226

227227
clientBuffer = (MI_Uint8*)malloc(clientBufferLength + 1);
228-
memset(&application, 0, sizeof(MI_Application));
229228
if(clientBuffer == NULL) {
230229
return;
231230
}
232-
MI_Application_Initialize(0,NULL,NULL, &application);
231+
if(MI_Application_Initialize(0,NULL,NULL, &application) != MI_RESULT_OK) {
232+
memset(&application, 0, sizeof(MI_Application));
233+
free(clientBuffer);
234+
MI_Application_Close(&application);
235+
return;
236+
}
237+
233238
result = XmlSerializer_Create(&application, 0, "MI_XML", &serializer);
234239
if (result != MI_RESULT_OK)
235240
{

‎Providers/nxGroup/MSFT_nxGroupResource.cpp

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,12 @@ void MI_CALL MSFT_nxGroupResource_Invoke_InventoryTargetResource(
231231
if(clientBuffer == NULL) {
232232
return;
233233
}
234-
MI_Application_Initialize(0,NULL,NULL, &application);
234+
if(MI_Application_Initialize(0,NULL,NULL, &application) != MI_RESULT_OK) {
235+
memset(&application, 0, sizeof(MI_Application));
236+
free(clientBuffer);
237+
MI_Application_Close(&application);
238+
return;
239+
}
235240
result = XmlSerializer_Create(&application, 0, "MI_XML", &serializer);
236241
if (result != MI_RESULT_OK)
237242
{

‎Providers/nxPackage/MSFT_nxPackageResource.cpp

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -231,8 +231,12 @@ void MI_CALL MSFT_nxPackageResource_Invoke_InventoryTargetResource(
231231
if(clientBuffer == NULL) {
232232
return;
233233
}
234-
memset(&application, 0, sizeof(MI_Application));
235-
MI_Application_Initialize(0,NULL,NULL, &application);
234+
if(MI_Application_Initialize(0,NULL,NULL, &application) != MI_RESULT_OK) {
235+
memset(&application, 0, sizeof(MI_Application));
236+
free(clientBuffer);
237+
MI_Application_Close(&application);
238+
return;
239+
}
236240
result = XmlSerializer_Create(&application, 0, "MI_XML", &serializer);
237241
if (result != MI_RESULT_OK)
238242
{

‎Providers/nxService/MSFT_nxServiceResource.cpp

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -228,8 +228,12 @@ void MI_CALL MSFT_nxServiceResource_Invoke_InventoryTargetResource(
228228
if(clientBuffer == NULL) {
229229
return;
230230
}
231-
memset(&application, 0, sizeof(MI_Application));
232-
MI_Application_Initialize(0,NULL,NULL, &application);
231+
if(MI_Application_Initialize(0,NULL,NULL, &application) != MI_RESULT_OK) {
232+
memset(&application, 0, sizeof(MI_Application));
233+
free(clientBuffer);
234+
MI_Application_Close(&application);
235+
return;
236+
}
233237
result = XmlSerializer_Create(&application, 0, "MI_XML", &serializer);
234238
if (result != MI_RESULT_OK)
235239
{

‎Providers/nxUser/MSFT_nxUserResource.cpp

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -231,8 +231,12 @@ void MI_CALL MSFT_nxUserResource_Invoke_InventoryTargetResource(
231231
if(clientBuffer == NULL) {
232232
return;
233233
}
234-
memset(&application, 0, sizeof(MI_Application));
235-
MI_Application_Initialize(0,NULL,NULL, &application);
234+
if(MI_Application_Initialize(0,NULL,NULL, &application) != MI_RESULT_OK) {
235+
memset(&application, 0, sizeof(MI_Application));
236+
free(clientBuffer);
237+
MI_Application_Close(&application);
238+
return;
239+
}
236240
result = XmlSerializer_Create(&application, 0, "MI_XML", &serializer);
237241
if (result != MI_RESULT_OK)
238242
{

0 commit comments

Comments
 (0)