• Sergei Golubchik's avatar
    completely rewrote file_key_management plugin · e02749aa
    Sergei Golubchik authored
    numerous issues fixed:
    * buffer overflows
    * error conditions aren't checked (crash if file doesn't exist)
    * accessing random unallocated memory
    * hard-coded password
    * arbitrary hard-coded key id limit
    * incomprehensible error messages (for key_id == 0 it reported
      "The key could not be initialized", for syntax errors the message was
      "Wrong match of the keyID, see the template", for a key id
      larger than hard-coded limit the message was "No asked key", and there
      was an error "Is comment" for a comment).
    * tons of small mallocs, many are freed few lines down in the code
    * malloc(N) and new char[N] are used both, even in the same function
    * redundant memory copies
    * pcre - "I can solve it with regular expressions" - with incorrect regexes
    * parser context stored in a singleton
    * keys are stored as strings and are strlen-ed and hex2bin-ed on every
      get_key() request
    * lots of useless code (e.g. sprintf instead of a pointer assignment,
      checking of the file length to read a part of it in a fixed buffer,
      multiplying by sizeof(char) in many places, etc)
    * this list is not exhaustive
    e02749aa
parser.cc 9.36 KB