[cpp-sp COMMIT] in /branches/REL_2: Shibboleth.sln odbc-store/odbc-store.cpp shibsp/handler/impl/AbstractHandler.cpp ...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Oct 10 22:56:33 2011
New Revision: 3526

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3526&view=rev
Log:
Check for overflow in storage APIs.

Modified:
    branches/REL_2/Shibboleth.sln
    branches/REL_2/odbc-store/odbc-store.cpp
    branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp
    branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp
    branches/REL_2/shibsp/impl/XMLServiceProvider.cpp

Modified: branches/REL_2/Shibboleth.sln
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/Shibboleth.sln?rev=3526&r1=3525&r2=3526&view=diff
==============================================================================
--- branches/REL_2/Shibboleth.sln (original)
+++ branches/REL_2/Shibboleth.sln Mon Oct 10 22:56:33 2011
@@ -252,10 +252,8 @@
 		{B2423DCE-048D-4BAA-9AB9-F5D1FCDD3D25}.Release|x64.ActiveCfg = Release|x64
 		{B2423DCE-048D-4BAA-9AB9-F5D1FCDD3D25}.Release|x64.Build.0 = Release|x64
 		{666A63A7-983F-4C19-8411-207F24305198}.Debug|Win32.ActiveCfg = Debug|Win32
-		{666A63A7-983F-4C19-8411-207F24305198}.Debug|Win32.Build.0 = Debug|Win32
 		{666A63A7-983F-4C19-8411-207F24305198}.Debug|x64.ActiveCfg = Debug|x64
 		{666A63A7-983F-4C19-8411-207F24305198}.Release|Win32.ActiveCfg = Release|Win32
-		{666A63A7-983F-4C19-8411-207F24305198}.Release|Win32.Build.0 = Release|Win32
 		{666A63A7-983F-4C19-8411-207F24305198}.Release|x64.ActiveCfg = Release|x64
 		{A2140D6E-C2C6-4329-84E3-2F530CEBE445}.Debug|Win32.ActiveCfg = Debug|Win32
 		{A2140D6E-C2C6-4329-84E3-2F530CEBE445}.Debug|Win32.Build.0 = Debug|Win32

Modified: branches/REL_2/odbc-store/odbc-store.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/odbc-store/odbc-store.cpp?rev=3526&r1=3525&r2=3526&view=diff
==============================================================================
--- branches/REL_2/odbc-store/odbc-store.cpp (original)
+++ branches/REL_2/odbc-store/odbc-store.cpp Mon Oct 10 22:56:33 2011
@@ -100,6 +100,9 @@
     static const XMLCh isolationLevel[] =   UNICODE_LITERAL_14(i,s,o,l,a,t,i,o,n,L,e,v,e,l);
     static const XMLCh ConnectionString[] = UNICODE_LITERAL_16(C,o,n,n,e,c,t,i,o,n,S,t,r,i,n,g);
     static const XMLCh RetryOnError[] =     UNICODE_LITERAL_12(R,e,t,r,y,O,n,E,r,r,o,r);
+    static const XMLCh contextSize[] =      UNICODE_LITERAL_11(c,o,n,t,e,x,t,S,i,z,e);
+    static const XMLCh keySize[] =          UNICODE_LITERAL_7(k,e,y,S,i,z,e);
+    static const XMLCh stringSize[] =       UNICODE_LITERAL_10(s,t,r,i,n,g,S,i,z,e);
 
     // RAII for ODBC handles
     struct ODBCConn {
@@ -124,6 +127,10 @@
         ODBCStorageService(const DOMElement* e);
         virtual ~ODBCStorageService();
 
+        const Capabilities& getCapabilities() const {
+            return m_caps;
+        }
+
         bool createString(const char* context, const char* key, const char* value, time_t expiration) {
             return createRow(STRING_TABLE, context, key, value, expiration);
         }
@@ -185,6 +192,7 @@
         void cleanup();
 
         Category& m_log;
+        Capabilities m_caps;
         int m_cleanupInterval;
         CondWait* shutdown_wait;
         Thread* cleanup_thread;
@@ -262,7 +270,8 @@
 };
 
 ODBCStorageService::ODBCStorageService(const DOMElement* e) : m_log(Category::getInstance("XMLTooling.StorageService")),
-   m_cleanupInterval(900), shutdown_wait(nullptr), cleanup_thread(nullptr), shutdown(false), m_henv(SQL_NULL_HANDLE), m_isolation(SQL_TXN_SERIALIZABLE)
+    m_caps(XMLHelper::getAttrInt(e, 255, contextSize), XMLHelper::getAttrInt(e, 255, keySize), XMLHelper::getAttrInt(e, 255, stringSize)),
+    m_cleanupInterval(900), shutdown_wait(nullptr), cleanup_thread(nullptr), shutdown(false), m_henv(SQL_NULL_HANDLE), m_isolation(SQL_TXN_SERIALIZABLE)
 {
 #ifdef _DEBUG
     xmltooling::NDC ndc("ODBCStorageService");

Modified: branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp?rev=3526&r1=3525&r2=3526&view=diff
==============================================================================
--- branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp (original)
+++ branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp Mon Oct 10 22:56:33 2011
@@ -294,8 +294,14 @@
                         string rsKey;
                         SAMLConfig::getConfig().generateRandomBytes(rsKey,32);
                         rsKey = SAMLArtifact::toHex(rsKey);
-                        if (!storage->createString("RelayState", rsKey.c_str(), relayState.c_str(), time(nullptr) + 600))
-                            throw IOException("Collision generating in-memory relay state key.");
+                        if (relayState.length() <= storage->getCapabilities().getStringSize()) {
+                            if (!storage->createString("RelayState", rsKey.c_str(), relayState.c_str(), time(nullptr) + 600))
+                                throw IOException("Collision generating in-memory relay state key.");
+                        }
+                        else {

[... 181 lines stripped ...]