geos_one/CASA
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Bug Debug 242407. Check size of passcode before allocating memory.

Browse Source 
Fix RemoveSecret offsets + Debug statements.
This commit is contained in:
Jim Norman 2007-02-05 23:47:39 +00:00
parent 2267f07397
commit d262d18b6f
4 changed files with 47 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
CASA/micasad/verbs/MergeCache.cs
View File

@ -61,12 +61,16 @@ namespace sscs.verbs
// get destroy flag
int iDestroySrcCache = BitConverter.ToInt32(inBuf, 38);
CSSSLogger.DbgLog(" SRC LUID found: " + luidHigh.ToString() + ":"+ luidLow.ToString());
CSSSLogger.DbgLog("Target LUID found: " + targetLuidHigh.ToString() +":" + targetLuidLow.ToString());
#if W32
// only allow the merge if the calling process is "System"
WinUserIdentifier callingUser = (WinUserIdentifier)userId;
if ((callingUser.GetUIDLow() == 999) && (callingUser.GetUIDHigh() == 0))
{
CSSSLogger.DbgLog("Caller is system process");
// get the store for the src
try
@ -97,6 +101,7 @@ namespace sscs.verbs
}
else
{
CSSSLogger.DbgLog("Caller is NOT system process, Merge not allowed!");
retCode = IPCRetCodes.SSCS_E_INVALID_INPUT;
}
#else

2
CASA/micasad/verbs/ReadKey.cs
View File

@ -167,7 +167,7 @@ namespace sscs.verbs
{
secret = keyChain.GetSecret(secretId);
KeyValue kv = secret.GetKeyValue(key);
if (kv != null)
if ((kv != null) && (kv.GetValue().Length > 0))
{
string valStr = secret.GetKeyValue(key).GetValue();
val = Encoding.UTF8.GetBytes(valStr);

12
CASA/micasad/verbs/RemoveSecret.cs
View File

@ -104,10 +104,13 @@ namespace sscs.verbs
Array.Copy(inBuf,(10+keyChainIdLen+4),secretIdArr,0,secretIdLen);
secretId = Encoding.UTF8.GetString(secretIdArr);
CSSSLogger.DbgLog("Deleting secret id: " + secretId);
try
{
CSSSLogger.DbgLog("Looking for extention");
// get extension ID
int extLocation = 14 + ((int)keyChainIdLen) + ((int)secretIdLen);
int extLocation = 18 + ((int)keyChainIdLen) + ((int)secretIdLen);
extId = BitConverter.ToUInt32(inBuf, extLocation);
}
catch (Exception)
@ -122,8 +125,11 @@ namespace sscs.verbs
// This is how the Login Capture module on windows, running as System, sets the Desktop Credential.
// we might be able to change this if/when we abstract the session.
// [4 byte extID][4 byte length][4 byte luidLow][4 byte luidHigh]
luidLow = BitConverter.ToInt32(inBuf, 14 + ((int)keyChainIdLen)+((int)secretIdLen) + 8);
luidHigh = BitConverter.ToInt32(inBuf, 14 + ((int)keyChainIdLen)+((int)secretIdLen) + 12);
luidLow = BitConverter.ToInt32(inBuf, 18 + ((int)keyChainIdLen)+((int)secretIdLen) + 8);
luidHigh = BitConverter.ToInt32(inBuf, 18 + ((int)keyChainIdLen)+((int)secretIdLen) + 12);
CSSSLogger.DbgLog("Extension found: " + luidHigh.ToString() + ":" + luidLow.ToString());
tempUserId = new WinUserIdentifier(luidLow, luidHigh);
SecretStore ss = SessionManager.CreateUserSession(tempUserId);
try

18
CASA/micasad/verbs/SetMasterPasscode.cs
View File

@ -78,8 +78,11 @@ namespace sscs.verbs
throw new FormatException(" MsgLen sent does not match the length of the message received.");
passcodeType = BitConverter.ToUInt32(inBuf,6);
passcodeLen = BitConverter.ToUInt32(inBuf,10);
if (passcodeLen < 64)
{
byte[] tempArr = new byte[passcodeLen];
Array.Copy(inBuf,14,tempArr,0,passcodeLen);
Array.Copy(inBuf, 14, tempArr, 0, passcodeLen);
passcode = Encoding.UTF8.GetString(tempArr);
// Message Format decipher - End
@ -88,22 +91,27 @@ namespace sscs.verbs
SecretStore ssStore = null;
ssStore = SessionManager.GetUserSecretStore(userId);
ssStore.PauseFileWatcher();
if(ssStore.SetMasterPasscode(passcode))
if (ssStore.SetMasterPasscode(passcode))
retCode = IPCRetCodes.SSCS_REPLY_SUCCESS;
else
retCode = IPCRetCodes.SSCS_E_SETTING_PASSCODE_FAILED;
ssStore.ResumeFileWatcher();
}
catch(UserNotInSessionException)
catch (UserNotInSessionException)
{
CSSSLogger.DbgLog("In " + CSSSLogger.GetExecutionPath(this) + " Unable to get user's secretstore" );
CSSSLogger.DbgLog("In " + CSSSLogger.GetExecutionPath(this) + " Unable to get user's secretstore");
retCode = IPCRetCodes.SSCS_E_SYSTEM_ERROR;
}
catch(Exception e)
catch (Exception e)
{
CSSSLogger.ExpLog(e.ToString());
retCode = IPCRetCodes.SSCS_E_SYSTEM_ERROR;
}
}
else
{
retCode = IPCRetCodes.SSCS_E_INVALID_INPUT;
}
try
{