已合并
AI扫描告警修复 #5317
AI扫描告警修复 #5317
已合并
王旭创建于 5月29日
10 个文件变更+39-8
@@ -160,7 +160,7 @@ int WriteUStr(Context *context, const unsigned char *uStr, unsigned int len)
160 return -1;160 return -1;
161 }161 }
162 162 
163- int inLen = (len << 1) + 1;163+ size_t inLen = ((size_t)len << 1) + 1;
164 char *buf = (char *)calloc(inLen + 1, sizeof(char));164 char *buf = (char *)calloc(inLen + 1, sizeof(char));
165 if (buf == NULL) {165 if (buf == NULL) {
166 return -1;166 return -1;
@@ -62,7 +62,11 @@ static int OnAccept(RpcServer *server, unsigned int mask)
62 Context *context = CreateContext(CONTEXT_BUFFER_MIN_SIZE);62 Context *context = CreateContext(CONTEXT_BUFFER_MIN_SIZE);
63 if (context != NULL) {63 if (context != NULL) {
64 context->fd = fd;64 context->fd = fd;
65- InsertHashTable(server->clients, context);65+ if (InsertHashTable(server->clients, context) < 0) {
66+ close(fd);
67+ ReleaseContext(context);
68+ return -1;
69+ }
66 AddFdEvent(server->loop, fd, READ_EVENT | WRIT_EVENT);70 AddFdEvent(server->loop, fd, READ_EVENT | WRIT_EVENT);
67 } else {71 } else {
68 close(fd);72 close(fd);
@@ -287,6 +291,9 @@ int EmitEvent(RpcServer *server, int event)
287 if (server == NULL) {291 if (server == NULL) {
288 return -1;292 return -1;
289 }293 }
294+ if (event < 0) {
295+ return -1;
296+ }
290 int num = sizeof(server->events) / sizeof(server->events[0]);297 int num = sizeof(server->events) / sizeof(server->events[0]);
291 pthread_mutex_lock(&server->mutex);298 pthread_mutex_lock(&server->mutex);
292 if (server->nEvents >= num) {299 if (server->nEvents >= num) {
@@ -308,7 +315,9 @@ int RegisterCallback(RpcServer *server, int event, Context *context)
308 if ((server == NULL) || (context == NULL)) {315 if ((server == NULL) || (context == NULL)) {
309 return -1;316 return -1;
310 }317 }
311- 318+ if (event < 0) {
319+ return -1;
320+ }
312 uint32_t num = sizeof(server->eventNode) / sizeof(server->eventNode[0]);321 uint32_t num = sizeof(server->eventNode) / sizeof(server->eventNode[0]);
313 int pos = event % num;322 int pos = event % num;
314 if (pos >= MAX_EVENT_NODE_COUNT) {323 if (pos >= MAX_EVENT_NODE_COUNT) {
@@ -336,6 +345,9 @@ int UnRegisterCallback(RpcServer *server, int event, const Context *context)
336 return -1;345 return -1;
337 }346 }
338 347 
348+ if (event < 0) {
349+ return -1;
350+ }
339 uint32_t num = sizeof(server->eventNode) / sizeof(server->eventNode[0]);351 uint32_t num = sizeof(server->eventNode) / sizeof(server->eventNode[0]);
340 int pos = event % num;352 int pos = event % num;
341 if (pos >= MAX_EVENT_NODE_COUNT) {353 if (pos >= MAX_EVENT_NODE_COUNT) {
@@ -412,6 +412,11 @@ void WifiControllerMachine::MakeConcreteManager(ConcreteManagerRole role, int id
412 WIFI_LOGE("Enter MakeConcreteManager");412 WIFI_LOGE("Enter MakeConcreteManager");
413 auto clientmode = std::make_shared<ConcreteClientModeManager>(role, id);413 auto clientmode = std::make_shared<ConcreteClientModeManager>(role, id);
414 clientmode->RegisterCallback(WifiManager::GetInstance().GetWifiTogglerManager()->GetConcreteCallback());414 clientmode->RegisterCallback(WifiManager::GetInstance().GetWifiTogglerManager()->GetConcreteCallback());
415+ ErrCode initRet = clientmode->InitConcreteManager();
416+ if (initRet != WIFI_OPT_SUCCESS) {
417+ WIFI_LOGE("InitConcreteManager failed");
418+ return;
419+ }
415 clientmode->InitConcreteManager();420 clientmode->InitConcreteManager();
416 concreteManagers.AddManager(clientmode);421 concreteManagers.AddManager(clientmode);
417}422}
@@ -838,7 +838,7 @@ int Get80211ElemsFromIE(const uint8_t *start, size_t len, struct HdiElems *elems
838 838 
839 switch (id) {839 switch (id) {
840 case HDI_EID_SSID:840 case HDI_EID_SSID:
841- if (elen > SSID_MAX_LEN || found_ssid) {841+ if (elen == 0 || elen > SSID_MAX_LEN || found_ssid) {
842 LOGI("Ignored too long SSID HdiElem (elen=%{public}u) or ssid found", elen);842 LOGI("Ignored too long SSID HdiElem (elen=%{public}u) or ssid found", elen);
843 break;843 break;
844 }844 }
@@ -1028,7 +1028,11 @@ WifiErrorNo HdiP2pConnect(P2pConnectInfo *info, char *replyPin, int size)
1028 wpsParam.goIntent = info->goIntent;1028 wpsParam.goIntent = info->goIntent;
1029 wpsParam.provdisc = info->provdisc;1029 wpsParam.provdisc = info->provdisc;
1030 uint8_t addr[ETH_ALEN];1030 uint8_t addr[ETH_ALEN];
1031- hwaddr_aton(info->peerDevAddr, addr);1031+ if (hwaddr_aton(info->peerDevAddr, addr) != 0) {
1032+ LOGE("HdiP2pConnect: peerDevAddr is invalid");
1033+ pthread_mutex_unlock(GetWpaObjMutex());
1034+ return WIFI_HAL_OPT_INVALID_PARAM;
1035+ }
1032 wpsParam.peerDevAddr = addr;1036 wpsParam.peerDevAddr = addr;
1033 wpsParam.peerDevAddrLen = ETH_ALEN;1037 wpsParam.peerDevAddrLen = ETH_ALEN;
1034 wpsParam.pin = (uint8_t *)info->pin;1038 wpsParam.pin = (uint8_t *)info->pin;
@@ -668,7 +668,7 @@ int32_t HalDeviceManager::IfaceSetTxPower(
668 if (iter != mWifiIfaces.end()) {668 if (iter != mWifiIfaces.end()) {
669 const sptr<IChipIface> &iface = iter->second;669 const sptr<IChipIface> &iface = iter->second;
670 CHECK_NULL_AND_RETURN(iface, false);670 CHECK_NULL_AND_RETURN(iface, false);
671- int32_t result = iface->SetTxPower(power);671+ result = iface->SetTxPower(power);
672 if (result != HDF_SUCCESS) {672 if (result != HDF_SUCCESS) {
673 LOGE("SetTxPower, call SetTxPower failed! Result:%{public}d", result);673 LOGE("SetTxPower, call SetTxPower failed! Result:%{public}d", result);
674 }674 }
@@ -1075,6 +1075,12 @@ void WifiP2pStub::OnHid2dSetPeerWifiCfgInfo(
1075 int cfgType = data.ReadInt32();1075 int cfgType = data.ReadInt32();
1076 int len = data.ReadInt32();1076 int len = data.ReadInt32();
1077 const char *dataBuffer = reinterpret_cast<const char *>(data.ReadBuffer(len));1077 const char *dataBuffer = reinterpret_cast<const char *>(data.ReadBuffer(len));
1078+ if (dataBuffer == nullptr) {
1079+ WIFI_LOGE("`%{public}s` dataBuffer is null", __func__);
1080+ reply.WriteInt32(0);
1081+ reply.WriteInt32(WIFI_OPT_FAILED);
1082+ return;
1083+ }
1078 if (memcpy_s(cfgData, CFG_DATA_MAX_BYTES, dataBuffer, len) != EOK) {1084 if (memcpy_s(cfgData, CFG_DATA_MAX_BYTES, dataBuffer, len) != EOK) {
1079 WIFI_LOGE("`%{public}s` memcpy_s failed!", __func__);1085 WIFI_LOGE("`%{public}s` memcpy_s failed!", __func__);
1080 reply.WriteInt32(0);1086 reply.WriteInt32(0);
@@ -136,7 +136,10 @@ bool WifiSecurityDetect::IsSettingSecurityDetectOn()
136 return false;136 return false;
137 }137 }
138 std::string valueResult;138 std::string valueResult;
139- resultSet->GoToFirstRow();139+ if (resultSet->GoToFirstRow() != DataShare::E_OK) {
140+ operatePtr->Release();
141+ return false;
142+ }
140 resultSet->GetString(0, valueResult);143 resultSet->GetString(0, valueResult);
141 if (valueResult == "1") {144 if (valueResult == "1") {
142 WIFI_LOGI("SecurityDetectOn");145 WIFI_LOGI("SecurityDetectOn");
@@ -397,7 +397,7 @@ void WifiDeviceStub::OnSetWifiRestrictedList(uint32_t code, MessageParcel &data,
397 int size = data.ReadInt32();397 int size = data.ReadInt32();
398 ErrCode ret = WIFI_OPT_FAILED;398 ErrCode ret = WIFI_OPT_FAILED;
399 int result = INVALID_NETWORK_ID;399 int result = INVALID_NETWORK_ID;
400- if (size > MAX_MDM_RESTRICTED_SIZE) {400+ if (size < 0 || size > MAX_MDM_RESTRICTED_SIZE) {
401 ret = WIFI_OPT_MDM_OUT_MAX_NUM;401 ret = WIFI_OPT_MDM_OUT_MAX_NUM;
402 } else {402 } else {
403 std::vector<WifiRestrictedInfo> wifiList;403 std::vector<WifiRestrictedInfo> wifiList;
@@ -169,6 +169,7 @@ bool WifiMultiVapManager::CheckEnhanceWifiConnected()
169 NI_NUMERICHOST);169 NI_NUMERICHOST);
170 if (ret != 0) {170 if (ret != 0) {
171 WIFI_LOGE("getnameinfo() failed: %{public}s\n", gai_strerror(ret));171 WIFI_LOGE("getnameinfo() failed: %{public}s\n", gai_strerror(ret));
172+ freeifaddrs(ifaddr);
172 return false;173 return false;
173 }174 }
174 }175 }