Changeset 26843 in vbox

Timestamp:

Feb 26, 2010 12:59:51 PM (15 years ago)

Author:

vboxsync

Message:

RTSystemQueryDmiString-darwin.cpp: fixed leaks and buffer overflow handling.

File:

• trunk/src/VBox/Runtime/r3/darwin/RTSystemQueryDmiString-darwin.cpp (modified) (7 diffs)

trunk/src/VBox/Runtime/r3/darwin/RTSystemQueryDmiString-darwin.cpp

@@ -36 +36 @@
 #include "internal/iprt.h"
 
+#include <iprt/assert.h>
 #include <iprt/err.h>
-#include <iprt/assert.h>
+#include <iprt/mem.h>
 #include <iprt/string.h>
 
@@ -43 +44 @@
 #include <IOKit/IOKitLib.h>
 
+
+/*******************************************************************************
+*   Defined Constants And Macros                                               *
+*******************************************************************************/
 #define IOCLASS_PLATFORMEXPERTDEVICE         "IOPlatformExpertDevice"
 #define PROP_PRODUCT_NAME                    "product-name"
@@ -48 +53 @@
 #define PROP_PRODUCT_SERIAL                  "IOPlatformSerialNumber"
 #define PROP_PRODUCT_UUID                    "IOPlatformUUID"
+
 
 RTDECL(int) RTSystemQueryDmiString(RTSYSDMISTR enmString, char *pszBuf, size_t cbBuf)
@@ -80 +86 @@
         return VERR_NOT_SUPPORTED;
 
+    /* IOServiceGetMatchingServices will always consume ClassToMatch. */
     io_iterator_t Iterator;
     kr = IOServiceGetMatchingServices(MasterPort, ClassToMatch, &Iterator);
@@ -92 +99 @@
             || enmString == RTSYSDMISTR_PRODUCT_VERSION)
         {
-            CFDataRef DataRef = (CFDataRef)IORegistryEntryCreateCFProperty(ServiceObject, PropStringRef, kCFAllocatorDefault, kNilOptions);
+            CFDataRef DataRef = (CFDataRef)IORegistryEntryCreateCFProperty(ServiceObject, PropStringRef,
+                                                                           kCFAllocatorDefault, kNilOptions);
             if (DataRef)
             {
-                size_t cbData = CFDataGetLength(DataRef);
-                const uint8_t *pu8Data = CFDataGetBytePtr(DataRef);
-                memcpy(pszBuf, pu8Data, RT_MIN(cbData, cbBuf));
-                pszBuf[RT_MIN(cbData + 1, cbBuf)] = '\0';
-                rc = VINF_SUCCESS;
+                size_t         cbData  = CFDataGetLength(DataRef);
+                const char    *pchData = (const char *)CFDataGetBytePtr(DataRef);
+                rc = RTStrCopyEx(pszBuf, cbBuf, pchData, cbData);
+                CFRelease(DataRef);
                 break;
             }
@@ -105 +112 @@
         else
         {
-            CFStringRef StringRef = (CFStringRef)IORegistryEntryCreateCFProperty(ServiceObject, PropStringRef, kCFAllocatorDefault, kNilOptions);
+            CFStringRef StringRef = (CFStringRef)IORegistryEntryCreateCFProperty(ServiceObject, PropStringRef,
+                                                                                 kCFAllocatorDefault, kNilOptions);
             if (StringRef)
             {
-                Boolean res = CFStringGetCString(StringRef, pszBuf, cbBuf, kCFStringEncodingASCII);
-                rc = res == TRUE ? VINF_SUCCESS : VERR_NOT_SUPPORTED;
+                Boolean fRc = CFStringGetCString(StringRef, pszBuf, cbBuf, kCFStringEncodingUTF8);
+                if (fRc)
+                    rc = VINF_SUCCESS;
+                else
+                {
+                    CFIndex cwc    = CFStringGetLength(StringRef);
+                    size_t  cbTmp  = cwc + 1;
+                    char   *pszTmp = (char *)RTMemTmpAlloc(cbTmp);
+                    int     cTries = 1;
+                    while (   pszTmp
+                           && (fRc = CFStringGetCString(StringRef, pszTmp, cbTmp, kCFStringEncodingUTF8)) == FALSE
+                           && cTries++ < 4)
+                    {
+                        RTMemTmpFree(pszTmp);
+                        cbTmp *= 2;
+                        pszTmp = (char *)RTMemTmpAlloc(cbTmp);
+                    }
+                    if (fRc)
+                        rc = RTStrCopy(pszBuf, cbBuf, pszTmp);
+                    else if (!pszTmp)
+                        rc = VERR_NO_TMP_MEMORY;
+                    else
+                        rc = VERR_ACCESS_DENIED;
+                    RTMemFree(pszTmp);
+                }
+                CFRelease(StringRef);
                 break;
             }
@@ -119 +151 @@
     return rc;
 }
+