From 4589494f128b6af5267632c1eafa66247fe2bf83 Mon Sep 17 00:00:00 2001 From: Daniel Adam Date: Tue, 27 Jun 2023 10:51:49 +0200 Subject: [PATCH] security: fix coverity issues 319210: Unitialized variables in oc_oscore_engine.c 319251: Resource leak in oc_oscore_context.c 319203, 319207, 319216, 319222, 319231, 319232, 319246, 319258: Resource leak in oc_obt.c 319217, 319227, 319229: Out-of-bounds access in oc_conv_byte_array_to_hex_string 319228: Uninitialized scalar variable in oc_obt.c --- api/oc_helpers.c | 11 +- include/oc_helpers.h | 29 +- onboarding_tool/obtmain.c | 2 +- python/oc_python.c | 4 + security/oc_cred.c | 80 ++-- security/oc_obt.c | 699 ++++++++++++++++++----------------- security/oc_oscore_context.c | 9 +- security/oc_oscore_engine.c | 2 +- 8 files changed, 446 insertions(+), 390 deletions(-) diff --git a/api/oc_helpers.c b/api/oc_helpers.c index 0215773161..44b7453b55 100644 --- a/api/oc_helpers.c +++ b/api/oc_helpers.c @@ -325,14 +325,13 @@ oc_conv_byte_array_to_hex_string(const uint8_t *array, size_t array_len, if (*hex_str_len < array_len * 2 + 1) { return -1; } - - *hex_str_len = 0; + size_t hlen = 0; for (size_t i = 0; i < array_len; i++) { - snprintf(hex_str + *hex_str_len, 3, "%02x", array[i]); - *hex_str_len += 2; + snprintf(hex_str + hlen, 3, "%02x", array[i]); + hlen += 2; } - hex_str[*hex_str_len++] = '\0'; - + hex_str[hlen] = '\0'; + *hex_str_len = hlen; return 0; } diff --git a/include/oc_helpers.h b/include/oc_helpers.h index 196c4a124a..0e0328992f 100644 --- a/include/oc_helpers.h +++ b/include/oc_helpers.h @@ -21,9 +21,11 @@ #ifndef OC_HELPERS_H #define OC_HELPERS_H +#include "oc_export.h" +#include "util/oc_compiler.h" #include "util/oc_list.h" #include "util/oc_mmem.h" -#include "oc_export.h" + #include #include #include @@ -282,7 +284,8 @@ void _oc_free_array( * @param str_len size of the string */ OC_API -void oc_set_string(oc_string_t *dst, const char *str, size_t str_len); +void oc_set_string(oc_string_t *dst, const char *str, size_t str_len) + OC_NONNULL(1); /** * @brief copy ocstring @@ -292,7 +295,7 @@ void oc_set_string(oc_string_t *dst, const char *str, size_t str_len); * is memset to zeroes) */ OC_API -void oc_copy_string(oc_string_t *dst, const oc_string_t *src); +void oc_copy_string(oc_string_t *dst, const oc_string_t *src) OC_NONNULL(1); /** * @brief new array @@ -324,28 +327,32 @@ void _oc_alloc_string_array( /** * @brief convert array to hex * - * @param[in] array array of bytes + * @param[in] array array of bytes (cannot be NULL) * @param[in] array_len length of the array - * @param hex_str data as hex - * @param hex_str_len lenght of the hex string + * @param[out] hex_str data as hex (cannot be NULL) + * @param[in,out] hex_str_len in: size of the hex_str array, out: string length + * of the output hex string (cannot be NULL) * @return int 0 success * @return int -1 on failure */ int oc_conv_byte_array_to_hex_string(const uint8_t *array, size_t array_len, - char *hex_str, size_t *hex_str_len); + char *hex_str, size_t *hex_str_len) + OC_NONNULL(); /** * @brief convert hex string to byte array * - * @param[in] hex_str hex string input + * @param[in] hex_str hex string input (cannot be NULL) * @param[in] hex_str_len size of the hex string - * @param array array of bytes - * @param array_len byte array + * @param[out] array array of bytes (cannot be NULL) + * @param[in,out] array_len in: size of the of the \p array, out: length of the + * output array (cannot be NULL) * @return int 0 success * @return int -1 on failure */ int oc_conv_hex_string_to_byte_array(const char *hex_str, size_t hex_str_len, - uint8_t *array, size_t *array_len); + uint8_t *array, size_t *array_len) + OC_NONNULL(); #ifdef __cplusplus } diff --git a/onboarding_tool/obtmain.c b/onboarding_tool/obtmain.c index f3a3c5520a..f4bf57d935 100644 --- a/onboarding_tool/obtmain.c +++ b/onboarding_tool/obtmain.c @@ -1637,7 +1637,6 @@ provision_ace2(void) i = 0; while (i < num_resources) { oc_ace_res_t *res = oc_obt_ace_new_resource(ace); - if (!res) { OC_PRINTF("\nERROR: Could not allocate new resource for ACE\n"); oc_obt_free_ace(ace); @@ -1715,6 +1714,7 @@ provision_ace2(void) OC_PRINTF("\nSuccessfully issued request to provision ACE\n"); } else { OC_PRINTF("\nERROR issuing request to provision ACE\n"); + oc_obt_free_ace(ace); } } diff --git a/python/oc_python.c b/python/oc_python.c index 764e1344ae..511c69c0da 100644 --- a/python/oc_python.c +++ b/python/oc_python.c @@ -1312,6 +1312,7 @@ py_provision_ace_cloud_access(const char *uuid) OC_PRINTF("[C] Successfully issued request to provision ACE\n"); } else { OC_PRINTF("[C] ERROR issuing request to provision ACE\n"); + oc_obt_free_ace(ace); } } @@ -1347,6 +1348,7 @@ py_provision_ace_to_obt(const char *uuid, const char *res_uri) OC_PRINTF("[C] Successfully issued request to provision ACE %s\n", res_uri); } else { OC_PRINTF("[C] ERROR issuing request to provision ACE %s\n", res_uri); + oc_obt_free_ace(ace); } } @@ -1385,6 +1387,7 @@ py_provision_ace_device_resources(const char *device_uuid, OC_PRINTF("[C] Successfully issued request to provision ACE\n"); } else { OC_PRINTF("[C] ERROR issuing request to provision ACE\n"); + oc_obt_free_ace(ace); } } @@ -1463,6 +1466,7 @@ py_provision_ace2(const char *target, const char *subject, const char *href, OC_PRINTF("[C] Successfully issued request to provision ACE\n"); } else { OC_PRINTF("[C] ERROR issuing request to provision ACE\n"); + oc_obt_free_ace(ace); } } diff --git a/security/oc_cred.c b/security/oc_cred.c index 82b8642dee..0b23a6e64b 100644 --- a/security/oc_cred.c +++ b/security/oc_cred.c @@ -860,6 +860,8 @@ oc_cred_read_credusage(oc_sec_credusage_t credusage) const char * oc_cred_read_encoding(oc_sec_encoding_t encoding) { + // TODO: use oc_string_view_t + switch (encoding) { case OC_ENCODING_BASE64: return OC_ENCODING_BASE64_STR; @@ -897,15 +899,18 @@ oc_sec_encode_roles(const oc_tls_peer_t *client, size_t device, oc_rep_set_int(roles, credtype, cr->credtype); /* credusage */ const char *credusage_string = oc_cred_read_credusage(cr->credusage); - if (strlen(credusage_string) > 4) { - oc_rep_set_text_string(roles, credusage, credusage_string); + size_t credusage_string_len = strlen(credusage_string); + if (credusage_string_len > 4) { + oc_rep_set_text_string_v1(roles, credusage, credusage_string, + credusage_string_len); } /* publicdata */ if (oc_string_len(cr->publicdata.data) > 0) { oc_rep_set_object(roles, publicdata); if (cr->publicdata.encoding == OC_ENCODING_PEM) { - oc_rep_set_text_string(publicdata, data, - oc_string(cr->publicdata.data)); + oc_rep_set_text_string_v1(publicdata, data, + oc_string(cr->publicdata.data), + oc_string_len(cr->publicdata.data)); } else { oc_rep_set_byte_string(publicdata, data, oc_cast(cr->publicdata.data, const uint8_t), @@ -913,8 +918,10 @@ oc_sec_encode_roles(const oc_tls_peer_t *client, size_t device, } const char *encoding_string = oc_cred_read_encoding(cr->publicdata.encoding); - if (strlen(encoding_string) > 7) { - oc_rep_set_text_string(publicdata, encoding, encoding_string); + size_t encoding_string_len = strlen(encoding_string); + if (encoding_string_len > 7) { + oc_rep_set_text_string_v1(publicdata, encoding, encoding_string, + encoding_string_len); } oc_rep_close_object(roles, publicdata); } @@ -946,7 +953,7 @@ oc_sec_encode_cred(size_t device, oc_interface_mask_t iface_mask, oc_rep_set_int(creds, credtype, cr->credtype); /* subjectuuid */ if (cr->subjectuuid.id[0] == '*') { - oc_rep_set_text_string(creds, subjectuuid, "*"); + oc_rep_set_text_string_v1(creds, subjectuuid, "*", 1); } else { oc_uuid_to_str(&cr->subjectuuid, uuid, OC_UUID_LEN); oc_rep_set_text_string(creds, subjectuuid, uuid); @@ -955,10 +962,12 @@ oc_sec_encode_cred(size_t device, oc_interface_mask_t iface_mask, if ((to_storage || cr->credtype == OC_CREDTYPE_PSK) && oc_string_len(cr->role.role) > 0) { oc_rep_set_object(creds, roleid); - oc_rep_set_text_string(roleid, role, oc_string(cr->role.role)); + oc_rep_set_text_string_v1(roleid, role, oc_string(cr->role.role), + oc_string_len(cr->role.role)); if (oc_string_len(cr->role.authority) > 0) { - oc_rep_set_text_string(roleid, authority, - oc_string(cr->role.authority)); + oc_rep_set_text_string_v1(roleid, authority, + oc_string(cr->role.authority), + oc_string_len(cr->role.authority)); } oc_rep_close_object(creds, roleid); } @@ -970,46 +979,49 @@ oc_sec_encode_cred(size_t device, oc_interface_mask_t iface_mask, oc_cast(cr->privatedata.data, const uint8_t), oc_string_len(cr->privatedata.data)); } else { - oc_rep_set_text_string(privatedata, data, - oc_string(cr->privatedata.data)); + oc_rep_set_text_string_v1(privatedata, data, + oc_string(cr->privatedata.data), + oc_string_len(cr->privatedata.data)); } } else { if (cr->privatedata.encoding == OC_ENCODING_RAW) { oc_rep_set_byte_string(privatedata, data, oc_cast(cr->privatedata.data, const uint8_t), 0); } else { - oc_rep_set_text_string(privatedata, data, ""); + oc_rep_set_text_string_v1(privatedata, data, "", 0); } } const char *encoding_string = oc_cred_read_encoding(cr->privatedata.encoding); - if (strlen(encoding_string) > 7) { - oc_rep_set_text_string(privatedata, encoding, encoding_string); - } else { - oc_rep_set_text_string(privatedata, encoding, OC_ENCODING_RAW_STR); + size_t encoding_string_len = strlen(encoding_string); + if (encoding_string_len <= 7) { + encoding_string = OC_ENCODING_RAW_STR; + encoding_string_len = OC_CHAR_ARRAY_LEN(OC_ENCODING_RAW_STR); } + oc_rep_set_text_string_v1(privatedata, encoding, encoding_string, + encoding_string_len); oc_rep_close_object(creds, privatedata); #ifdef OC_OSCORE /* oscore */ if (cr->oscore_ctx) { oc_oscore_context_t *oscore_ctx = (oc_oscore_context_t *)cr->oscore_ctx; char hex_str[OSCORE_CTXID_LEN * 2 + 1]; - size_t hex_str_len; oc_rep_set_object(creds, oscore); if (cr->credtype != OC_CREDTYPE_OSCORE_MCAST_SERVER) { - hex_str_len = OSCORE_CTXID_LEN * 2 + 1; + size_t hex_str_len = sizeof(hex_str); oc_conv_byte_array_to_hex_string( oscore_ctx->sendid, oscore_ctx->sendid_len, hex_str, &hex_str_len); - oc_rep_set_text_string(oscore, senderid, hex_str); + oc_rep_set_text_string_v1(oscore, senderid, hex_str, hex_str_len); } if (cr->credtype != OC_CREDTYPE_OSCORE_MCAST_CLIENT) { - hex_str_len = OSCORE_CTXID_LEN * 2 + 1; + size_t hex_str_len = sizeof(hex_str); oc_conv_byte_array_to_hex_string( oscore_ctx->recvid, oscore_ctx->recvid_len, hex_str, &hex_str_len); - oc_rep_set_text_string(oscore, recipientid, hex_str); + oc_rep_set_text_string_v1(oscore, recipientid, hex_str, hex_str_len); } if (cr->credtype != OC_CREDTYPE_OSCORE) { - oc_rep_set_text_string(oscore, desc, oc_string(oscore_ctx->desc)); + oc_rep_set_text_string_v1(oscore, desc, oc_string(oscore_ctx->desc), + oc_string_len(oscore_ctx->desc)); } if (cr->credtype != OC_CREDTYPE_OSCORE_MCAST_SERVER) { oc_rep_set_int(oscore, ssn, oscore_ctx->ssn); @@ -1020,15 +1032,18 @@ oc_sec_encode_cred(size_t device, oc_interface_mask_t iface_mask, #ifdef OC_PKI /* credusage */ const char *credusage_string = oc_cred_read_credusage(cr->credusage); - if (strlen(credusage_string) > 4) { - oc_rep_set_text_string(creds, credusage, credusage_string); + size_t credusage_string_len = strlen(credusage_string); + if (credusage_string_len > 4) { + oc_rep_set_text_string_v1(creds, credusage, credusage_string, + credusage_string_len); } /* publicdata */ if (oc_string_len(cr->publicdata.data) > 0) { oc_rep_set_object(creds, publicdata); if (cr->publicdata.encoding == OC_ENCODING_PEM) { - oc_rep_set_text_string(publicdata, data, - oc_string(cr->publicdata.data)); + oc_rep_set_text_string_v1(publicdata, data, + oc_string(cr->publicdata.data), + oc_string_len(cr->publicdata.data)); } else { oc_rep_set_byte_string(publicdata, data, oc_cast(cr->publicdata.data, const uint8_t), @@ -1036,15 +1051,18 @@ oc_sec_encode_cred(size_t device, oc_interface_mask_t iface_mask, } const char *encoding_string = oc_cred_read_encoding(cr->publicdata.encoding); - if (strlen(encoding_string) > 7) { - oc_rep_set_text_string(publicdata, encoding, encoding_string); + size_t encoding_string_len = strlen(encoding_string); + if (encoding_string_len > 7) { + oc_rep_set_text_string_v1(publicdata, encoding, encoding_string, + encoding_string_len); } oc_rep_close_object(creds, publicdata); } if (to_storage) { oc_rep_set_boolean(creds, owner_cred, cr->owner_cred); - if ((oc_string(cr->tag) != NULL) && (oc_string_len(cr->tag) > 0)) { - oc_rep_set_text_string(creds, tag, oc_string(cr->tag)); + if (oc_string_len(cr->tag) > 0) { + oc_rep_set_text_string_v1(creds, tag, oc_string(cr->tag), + oc_string_len(cr->tag)); } } #endif /* OC_PKI */ diff --git a/security/oc_obt.c b/security/oc_obt.c index acb945ceac..c88005afeb 100644 --- a/security/oc_obt.c +++ b/security/oc_obt.c @@ -43,6 +43,9 @@ check oc_config.h and make sure OC_STORAGE is defined if OC_SECURITY is defined. #include "security/oc_security_internal.h" #include "security/oc_sdi_internal.h" #include "security/oc_tls_internal.h" +#include "util/oc_macros_internal.h" + +#include #include OC_MEMB(oc_discovery_s, oc_discovery_cb_t, 1); @@ -142,7 +145,7 @@ get_device_handle(const oc_uuid_t *uuid, oc_list_t list) { oc_device_t *device = (oc_device_t *)oc_list_head(list); while (device) { - if (memcmp(uuid->id, device->uuid.id, 16) == 0) { + if (memcmp(uuid->id, device->uuid.id, sizeof(device->uuid.id)) == 0) { return device; } device = device->next; @@ -459,30 +462,104 @@ free_discovery_cb(void *data) return OC_EVENT_DONE; } +static oc_endpoint_t * +update_endpoint(const oc_rep_t *eps, const oc_endpoint_t *endpoint, + const oc_uuid_t *di) +{ + for (const oc_rep_t *ep = eps; ep != NULL; ep = ep->next) { + if (ep->type != OC_REP_STRING && + !oc_string_is_cstr_equal(&ep->name, "ep", OC_CHAR_ARRAY_LEN("ep"))) { + continue; + } + + oc_endpoint_t temp_ep; + if (oc_string_to_endpoint(&ep->value.string, &temp_ep, NULL) != 0) { + OC_ERR("oc_obt: error parsing endpoint"); + continue; + } + if (((endpoint->flags & IPV4) && (temp_ep.flags & IPV6)) || + ((endpoint->flags & IPV6) && (temp_ep.flags & IPV4))) { + return NULL; + } + + oc_endpoint_t *ep_new = oc_new_endpoint(); + if (ep_new == NULL) { + OC_ERR("oc_obt: cannot allocate endpoint"); + return NULL; + } + + memcpy(ep_new, &temp_ep, sizeof(oc_endpoint_t)); + ep_new->next = NULL; + ep_new->device = endpoint->device; + oc_endpoint_set_di(ep_new, di); + ep_new->interface_index = endpoint->interface_index; + oc_endpoint_set_local_address(ep_new, ep_new->interface_index); + if (oc_ipv6_endpoint_is_link_local(ep_new) == 0 && + oc_ipv6_endpoint_is_link_local(endpoint) == 0) { + ep_new->addr.ipv6.scope = endpoint->addr.ipv6.scope; + } + return ep_new; + } + + return NULL; +} + +static void +update_endpoints_from_links(oc_device_t *device, const oc_endpoint_t *endpoint, + const oc_uuid_t *di, const oc_rep_t *links) +{ + oc_endpoint_t *eps_cur = NULL; + for (const oc_rep_t *link = links; link != NULL; link = link->next) { + if (link->type != OC_REP_OBJECT_ARRAY) { + continue; + } + for (const oc_rep_t *eps = link->value.object_array; eps != NULL; + eps = eps->next) { + oc_endpoint_t *ep_new = update_endpoint(eps->value.object, endpoint, di); + if (ep_new == NULL) { + continue; + } + + if (eps_cur != NULL) { + eps_cur->next = ep_new; + eps_cur = eps_cur->next; + } else { + eps_cur = ep_new; + device->endpoint = eps_cur; + } + } + } +} + static void get_endpoints(oc_client_response_t *data) { if (data->code >= OC_STATUS_BAD_REQUEST) { return; } - oc_uuid_t di; + oc_rep_t *links = data->payload; - oc_rep_t *link = links != NULL ? links->value.object : NULL; - while (link != NULL) { - switch (link->type) { - case OC_REP_STRING: { - if (oc_string_len(link->name) == 6 && - memcmp(oc_string(link->name), "anchor", 6) == 0) { - oc_str_to_uuid(oc_string(link->value.string) + 6, &di); - break; - } - } break; - default: + if (links == NULL) { + return; + } + const oc_string_t *anchor = NULL; + assert(links->type == OC_REP_OBJECT); + for (oc_rep_t *link = links->value.object; link != NULL; link = link->next) { + if (link->type == OC_REP_STRING && + oc_string_is_cstr_equal(&link->name, "anchor", + OC_CHAR_ARRAY_LEN("anchor"))) { + anchor = &link->value.string; break; } - link = link->next; } + if (anchor == NULL) { + return; + } + + oc_uuid_t di = { 0 }; + // skip "ocf://" prefix + oc_str_to_uuid(oc_string(*anchor) + 6, &di); const oc_uuid_t *my_uuid = oc_core_get_device_id(0); if (memcmp(my_uuid->id, di.id, sizeof(di.id)) == 0) { return; @@ -501,77 +578,15 @@ get_endpoints(oc_client_response_t *data) cb = (oc_discovery_cb_t *)device->ctx; } - if (!device) { + if (device == NULL) { return; } oc_free_server_endpoints(device->endpoint); device->endpoint = NULL; + update_endpoints_from_links(device, data->endpoint, &di, links->value.object); - if (links == NULL) { - return; - } - link = links->value.object; - oc_endpoint_t *eps_cur = NULL; - while (link != NULL) { - switch (link->type) { - case OC_REP_OBJECT_ARRAY: { - oc_rep_t *eps = link->value.object_array; - while (eps != NULL) { - oc_rep_t *ep = eps->value.object; - while (ep != NULL) { - switch (ep->type) { - case OC_REP_STRING: { - if (oc_string_len(ep->name) == 2 && - memcmp(oc_string(ep->name), "ep", 2) == 0) { - oc_endpoint_t temp_ep; - if (oc_string_to_endpoint(&ep->value.string, &temp_ep, NULL) == - 0) { - if (((data->endpoint->flags & IPV4) && - (temp_ep.flags & IPV6)) || - ((data->endpoint->flags & IPV6) && - (temp_ep.flags & IPV4))) { - goto next_ep; - } - if (eps_cur) { - eps_cur->next = oc_new_endpoint(); - eps_cur = eps_cur->next; - } else { - eps_cur = device->endpoint = oc_new_endpoint(); - } - - if (eps_cur) { - memcpy(eps_cur, &temp_ep, sizeof(oc_endpoint_t)); - eps_cur->next = NULL; - eps_cur->device = data->endpoint->device; - oc_endpoint_set_di(eps_cur, &di); - eps_cur->interface_index = data->endpoint->interface_index; - oc_endpoint_set_local_address( - eps_cur, data->endpoint->interface_index); - if (oc_ipv6_endpoint_is_link_local(eps_cur) == 0 && - oc_ipv6_endpoint_is_link_local(data->endpoint) == 0) { - eps_cur->addr.ipv6.scope = data->endpoint->addr.ipv6.scope; - } - } - } - } - } break; - default: - break; - } - ep = ep->next; - } - next_ep: - eps = eps->next; - } - } break; - default: - break; - } - link = link->next; - } - - if (!is_item_in_list(oc_discovery_cbs, cb) || !device->endpoint) { + if (!is_item_in_list(oc_discovery_cbs, cb) || device->endpoint == NULL) { return; } cb->cb(&device->uuid, device->endpoint, cb->data); @@ -895,33 +910,31 @@ int oc_obt_device_hard_reset(const oc_uuid_t *uuid, oc_obt_device_status_cb_t cb, void *data) { - oc_hard_reset_ctx_t *d = - (oc_hard_reset_ctx_t *)oc_memb_alloc(&oc_hard_reset_ctx_m); - if (!d) { + if (!oc_obt_is_owned_device(uuid)) { return -1; } - if (!oc_obt_is_owned_device(uuid)) { + oc_device_t *device = oc_obt_get_owned_device_handle(uuid); + if (device == NULL) { return -1; } - oc_device_t *device = oc_obt_get_owned_device_handle(uuid); - if (!device) { + oc_hard_reset_ctx_t *d = + (oc_hard_reset_ctx_t *)oc_memb_alloc(&oc_hard_reset_ctx_m); + if (d == NULL) { return -1; } d->cb.cb = cb; d->cb.data = data; d->device = device; - d->switch_dos = switch_dos(device, OC_DOS_RESET, hard_reset_cb, d); - if (!d->switch_dos) { + if (d->switch_dos == NULL) { oc_memb_free(&oc_hard_reset_ctx_m, d); return -1; } oc_list_add(oc_hard_reset_ctx_l, d); - return 0; } /* End of hard RESET sequence */ @@ -1023,53 +1036,57 @@ device1oscore_cred(oc_client_response_t *data) oc_oscoreprov_ctx_t *p = (oc_oscoreprov_ctx_t *)data->user_data; if (data->code >= OC_STATUS_BAD_REQUEST) { - free_oscoreprov_ctx(p, -1); - return; + goto error; } - char d1uuid[OC_UUID_LEN]; oc_uuid_to_str(&p->device1->uuid, d1uuid, OC_UUID_LEN); - char hex_str[OSCORE_CTXID_LEN * 2 + 1]; - size_t hex_str_len; + const oc_endpoint_t *ep = oc_obt_get_secure_endpoint(p->device2->endpoint); + if (!oc_init_post("/oic/sec/cred", ep, NULL, &device2oscore_cred, HIGH_QOS, + p)) { + goto error; + } - if (oc_init_post("/oic/sec/cred", ep, NULL, &device2oscore_cred, HIGH_QOS, - p)) { - oc_rep_start_root_object(); - oc_rep_set_array(root, creds); - oc_rep_object_array_start_item(creds); + oc_rep_start_root_object(); + oc_rep_set_array(root, creds); + oc_rep_object_array_start_item(creds); - oc_rep_set_int(creds, credtype, OC_CREDTYPE_OSCORE); - oc_rep_set_text_string(creds, subjectuuid, d1uuid); + oc_rep_set_int(creds, credtype, OC_CREDTYPE_OSCORE); + oc_rep_set_text_string(creds, subjectuuid, d1uuid); - oc_rep_set_object(creds, privatedata); - oc_rep_set_byte_string(privatedata, data, p->secret, - OSCORE_MASTER_SECRET_LEN); - oc_rep_set_text_string(privatedata, encoding, OC_ENCODING_RAW_STR); - oc_rep_close_object(creds, privatedata); + oc_rep_set_object(creds, privatedata); + oc_rep_set_byte_string(privatedata, data, p->secret, + OSCORE_MASTER_SECRET_LEN); + oc_rep_set_text_string_v1(privatedata, encoding, OC_ENCODING_RAW_STR, + OC_CHAR_ARRAY_LEN(OC_ENCODING_RAW_STR)); + oc_rep_close_object(creds, privatedata); - oc_rep_set_object(creds, oscore); + oc_rep_set_object(creds, oscore); - hex_str_len = OSCORE_CTXID_LEN * 2 + 1; - oc_conv_byte_array_to_hex_string(p->recvid, OSCORE_CTXID_LEN, hex_str, - &hex_str_len); - oc_rep_set_text_string(oscore, senderid, hex_str); + char hex_str[OSCORE_CTXID_LEN * 2 + 1]; + size_t hex_str_len = sizeof(hex_str); + oc_conv_byte_array_to_hex_string(p->recvid, OSCORE_CTXID_LEN, hex_str, + &hex_str_len); + oc_rep_set_text_string_v1(oscore, senderid, hex_str, hex_str_len); - hex_str_len = OSCORE_CTXID_LEN * 2 + 1; - oc_conv_byte_array_to_hex_string(p->sendid, OSCORE_CTXID_LEN, hex_str, - &hex_str_len); - oc_rep_set_text_string(oscore, recipientid, hex_str); + hex_str_len = sizeof(hex_str); + oc_conv_byte_array_to_hex_string(p->sendid, OSCORE_CTXID_LEN, hex_str, + &hex_str_len); + oc_rep_set_text_string_v1(oscore, recipientid, hex_str, hex_str_len); - oc_rep_close_object(creds, oscore); + oc_rep_close_object(creds, oscore); - oc_rep_object_array_end_item(creds); - oc_rep_close_array(root, creds); - oc_rep_end_root_object(); - if (oc_do_post()) { - return; - } + oc_rep_object_array_end_item(creds); + oc_rep_close_array(root, creds); + oc_rep_end_root_object(); + + if (!oc_do_post()) { + goto error; } + return; + +error: free_oscoreprov_ctx(p, -1); } @@ -1083,55 +1100,62 @@ device2oscore_RFPRO(int status, void *data) oc_oscoreprov_ctx_t *p = (oc_oscoreprov_ctx_t *)data; p->switch_dos = NULL; - if (status >= 0) { - gen_oscore_ctxid(p->sendid, false); - gen_oscore_ctxid(p->recvid, false); - oc_random_buffer(p->secret, sizeof(p->secret)); + if (status < 0) { + goto error; + } - char d2uuid[OC_UUID_LEN]; - oc_uuid_to_str(&p->device2->uuid, d2uuid, OC_UUID_LEN); - char hex_str[OSCORE_CTXID_LEN * 2 + 1]; - size_t hex_str_len; - const oc_endpoint_t *ep = oc_obt_get_secure_endpoint(p->device1->endpoint); + gen_oscore_ctxid(p->sendid, false); + gen_oscore_ctxid(p->recvid, false); + oc_random_buffer(p->secret, sizeof(p->secret)); - if (oc_init_post("/oic/sec/cred", ep, NULL, &device1oscore_cred, HIGH_QOS, - p)) { - oc_rep_start_root_object(); - oc_rep_set_array(root, creds); - oc_rep_object_array_start_item(creds); + char d2uuid[OC_UUID_LEN]; + oc_uuid_to_str(&p->device2->uuid, d2uuid, OC_UUID_LEN); + const oc_endpoint_t *ep = oc_obt_get_secure_endpoint(p->device1->endpoint); + if (!oc_init_post("/oic/sec/cred", ep, NULL, &device1oscore_cred, HIGH_QOS, + p)) { + goto error; + } - oc_rep_set_int(creds, credtype, OC_CREDTYPE_OSCORE); - oc_rep_set_text_string(creds, subjectuuid, d2uuid); + oc_rep_start_root_object(); + oc_rep_set_array(root, creds); + oc_rep_object_array_start_item(creds); - oc_rep_set_object(creds, privatedata); - oc_rep_set_byte_string(privatedata, data, p->secret, - OSCORE_MASTER_SECRET_LEN); - oc_rep_set_text_string(privatedata, encoding, OC_ENCODING_RAW_STR); - oc_rep_close_object(creds, privatedata); + oc_rep_set_int(creds, credtype, OC_CREDTYPE_OSCORE); + oc_rep_set_text_string(creds, subjectuuid, d2uuid); + + oc_rep_set_object(creds, privatedata); + oc_rep_set_byte_string(privatedata, data, p->secret, + OSCORE_MASTER_SECRET_LEN); + oc_rep_set_text_string_v1(privatedata, encoding, OC_ENCODING_RAW_STR, + OC_CHAR_ARRAY_LEN(OC_ENCODING_RAW_STR)); + oc_rep_close_object(creds, privatedata); - oc_rep_set_object(creds, oscore); + oc_rep_set_object(creds, oscore); - hex_str_len = OSCORE_CTXID_LEN * 2 + 1; - oc_conv_byte_array_to_hex_string(p->sendid, OSCORE_CTXID_LEN, hex_str, - &hex_str_len); - oc_rep_set_text_string(oscore, senderid, hex_str); + char hex_str[OSCORE_CTXID_LEN * 2 + 1]; + size_t hex_str_len = sizeof(hex_str); + oc_conv_byte_array_to_hex_string(p->sendid, OSCORE_CTXID_LEN, hex_str, + &hex_str_len); + oc_rep_set_text_string_v1(oscore, senderid, hex_str, hex_str_len); - hex_str_len = OSCORE_CTXID_LEN * 2 + 1; - oc_conv_byte_array_to_hex_string(p->recvid, OSCORE_CTXID_LEN, hex_str, - &hex_str_len); - oc_rep_set_text_string(oscore, recipientid, hex_str); + hex_str_len = sizeof(hex_str); + oc_conv_byte_array_to_hex_string(p->recvid, OSCORE_CTXID_LEN, hex_str, + &hex_str_len); + oc_rep_set_text_string_v1(oscore, recipientid, hex_str, hex_str_len); - oc_rep_close_object(creds, oscore); + oc_rep_close_object(creds, oscore); - oc_rep_object_array_end_item(creds); - oc_rep_close_array(root, creds); - oc_rep_end_root_object(); - if (oc_do_post()) { - return; - } - } + oc_rep_object_array_end_item(creds); + oc_rep_close_array(root, creds); + oc_rep_end_root_object(); + + if (!oc_do_post()) { + goto error; } + return; + +error: free_oscoreprov_state(p, -1); } @@ -1160,26 +1184,21 @@ oc_obt_provision_pairwise_oscore_contexts(const oc_uuid_t *uuid1, const oc_uuid_t *uuid2, oc_obt_status_cb_t cb, void *data) { - oc_oscoreprov_ctx_t *p = oc_memb_alloc(&oc_oscoreprov_ctx_m); - if (!p) { - return -1; - } - - if (!oc_obt_is_owned_device(uuid1)) { + if (!oc_obt_is_owned_device(uuid1) || !oc_obt_is_owned_device(uuid2)) { return -1; } - if (!oc_obt_is_owned_device(uuid2)) { + oc_device_t *device1 = oc_obt_get_owned_device_handle(uuid1); + if (device1 == NULL) { return -1; } - - oc_device_t *device1 = oc_obt_get_owned_device_handle(uuid1); - if (!device1) { + oc_device_t *device2 = oc_obt_get_owned_device_handle(uuid2); + if (device2 == NULL) { return -1; } - oc_device_t *device2 = oc_obt_get_owned_device_handle(uuid2); - if (!device2) { + oc_oscoreprov_ctx_t *p = oc_memb_alloc(&oc_oscoreprov_ctx_m); + if (p == NULL) { return -1; } @@ -1191,13 +1210,12 @@ oc_obt_provision_pairwise_oscore_contexts(const oc_uuid_t *uuid1, oc_tls_select_psk_ciphersuite(); p->switch_dos = switch_dos(device1, OC_DOS_RFPRO, device1oscore_RFPRO, p); - if (!p->switch_dos) { + if (p->switch_dos == NULL) { oc_memb_free(&oc_oscoreprov_ctx_m, p); return -1; } oc_list_add(oc_oscoreprov_ctx_l, p); - return 0; } /* End of provision pairwise OSCORE contexts sequence */ @@ -1267,52 +1285,58 @@ deviceoscoregroup_RFPRO(int status, void *data) return; } oc_oscoregroupprov_ctx_t *p = (oc_oscoregroupprov_ctx_t *)data; - p->switch_dos = NULL; - if (status >= 0) { - char groupsub[OC_UUID_LEN]; - oc_uuid_to_str(&p->subjectuuid, groupsub, OC_UUID_LEN); - char hex_str[OSCORE_CTXID_LEN * 2 + 1]; - size_t hex_str_len; - const oc_endpoint_t *ep = oc_obt_get_secure_endpoint(p->device->endpoint); + if (status < 0) { + goto error; + } - if (oc_init_post("/oic/sec/cred", ep, NULL, &deviceoscoregroup_cred, - HIGH_QOS, p)) { - oc_rep_start_root_object(); - oc_rep_set_array(root, creds); - oc_rep_object_array_start_item(creds); + char groupsub[OC_UUID_LEN]; + oc_uuid_to_str(&p->subjectuuid, groupsub, OC_UUID_LEN); + const oc_endpoint_t *ep = oc_obt_get_secure_endpoint(p->device->endpoint); + if (!oc_init_post("/oic/sec/cred", ep, NULL, &deviceoscoregroup_cred, + HIGH_QOS, p)) { + goto error; + } + oc_rep_start_root_object(); + oc_rep_set_array(root, creds); + oc_rep_object_array_start_item(creds); - oc_rep_set_int(creds, credtype, p->type); - oc_rep_set_text_string(creds, subjectuuid, groupsub); + oc_rep_set_int(creds, credtype, p->type); + oc_rep_set_text_string(creds, subjectuuid, groupsub); - oc_rep_set_object(creds, privatedata); - oc_rep_set_byte_string(privatedata, data, g_group_secret, - OSCORE_MASTER_SECRET_LEN); - oc_rep_set_text_string(privatedata, encoding, OC_ENCODING_RAW_STR); - oc_rep_close_object(creds, privatedata); + oc_rep_set_object(creds, privatedata); + oc_rep_set_byte_string(privatedata, data, g_group_secret, + OSCORE_MASTER_SECRET_LEN); + oc_rep_set_text_string_v1(privatedata, encoding, OC_ENCODING_RAW_STR, + OC_CHAR_ARRAY_LEN(OC_ENCODING_RAW_STR)); + oc_rep_close_object(creds, privatedata); - oc_rep_set_object(creds, oscore); + oc_rep_set_object(creds, oscore); - hex_str_len = OSCORE_CTXID_LEN * 2 + 1; - oc_conv_byte_array_to_hex_string(g_groupid, OSCORE_CTXID_LEN, hex_str, - &hex_str_len); - if (p->type == OC_CREDTYPE_OSCORE_MCAST_CLIENT) { - oc_rep_set_text_string(oscore, senderid, hex_str); - } else { - oc_rep_set_text_string(oscore, recipientid, hex_str); - } - oc_rep_set_text_string(oscore, desc, oc_string(p->desc)); - oc_rep_close_object(creds, oscore); - oc_rep_object_array_end_item(creds); - oc_rep_close_array(root, creds); - oc_rep_end_root_object(); - if (oc_do_post()) { - return; - } - } + char hex_str[OSCORE_CTXID_LEN * 2 + 1]; + size_t hex_str_len = sizeof(hex_str); + oc_conv_byte_array_to_hex_string(g_groupid, OSCORE_CTXID_LEN, hex_str, + &hex_str_len); + if (p->type == OC_CREDTYPE_OSCORE_MCAST_CLIENT) { + oc_rep_set_text_string_v1(oscore, senderid, hex_str, hex_str_len); + } else { + oc_rep_set_text_string_v1(oscore, recipientid, hex_str, hex_str_len); } + oc_rep_set_text_string_v1(oscore, desc, oc_string(p->desc), + oc_string_len(p->desc)); + oc_rep_close_object(creds, oscore); + oc_rep_object_array_end_item(creds); + oc_rep_close_array(root, creds); + oc_rep_end_root_object(); + + if (!oc_do_post()) { + goto error; + } + + return; +error: free_oscoregroupprov_state(p, -1); } @@ -1323,17 +1347,17 @@ obt_provision_group_oscore_context(const oc_uuid_t *uuid, oc_obt_device_status_cb_t cb, oc_sec_credtype_t type, void *data) { - oc_oscoregroupprov_ctx_t *p = oc_memb_alloc(&oc_oscoregroupprov_ctx_m); - if (!p) { + if (!oc_obt_is_owned_device(uuid)) { return -1; } - if (!oc_obt_is_owned_device(uuid)) { + oc_device_t *device = oc_obt_get_owned_device_handle(uuid); + if (device == NULL) { return -1; } - oc_device_t *device = oc_obt_get_owned_device_handle(uuid); - if (!device) { + oc_oscoregroupprov_ctx_t *p = oc_memb_alloc(&oc_oscoregroupprov_ctx_m); + if (p == NULL) { return -1; } @@ -1344,18 +1368,18 @@ obt_provision_group_oscore_context(const oc_uuid_t *uuid, if (desc) { oc_new_string(&p->desc, desc, strlen(desc)); } - memcpy(p->subjectuuid.id, subjectuuid->id, 16); + memcpy(p->subjectuuid.id, subjectuuid->id, sizeof(subjectuuid->id)); oc_tls_select_psk_ciphersuite(); p->switch_dos = switch_dos(device, OC_DOS_RFPRO, deviceoscoregroup_RFPRO, p); if (!p->switch_dos) { + oc_free_string(&p->desc); oc_memb_free(&oc_oscoregroupprov_ctx_m, p); return -1; } oc_list_add(oc_oscoregroupprov_ctx_l, p); - return 0; } @@ -1505,8 +1529,9 @@ device1_cred(oc_client_response_t *data) oc_rep_set_text_string(creds, subjectuuid, d1uuid); oc_rep_set_object(creds, privatedata); - oc_rep_set_byte_string(privatedata, data, p->key, 16); - oc_rep_set_text_string(privatedata, encoding, OC_ENCODING_RAW_STR); + oc_rep_set_byte_string(privatedata, data, p->key, sizeof(p->key)); + oc_rep_set_text_string_v1(privatedata, encoding, OC_ENCODING_RAW_STR, + OC_CHAR_ARRAY_LEN(OC_ENCODING_RAW_STR)); oc_rep_close_object(creds, privatedata); oc_rep_object_array_end_item(creds); @@ -1547,8 +1572,9 @@ device2_RFPRO(int status, void *data) oc_rep_set_text_string(creds, subjectuuid, d2uuid); oc_rep_set_object(creds, privatedata); - oc_rep_set_byte_string(privatedata, data, p->key, 16); - oc_rep_set_text_string(privatedata, encoding, OC_ENCODING_RAW_STR); + oc_rep_set_byte_string(privatedata, data, p->key, sizeof(p->key)); + oc_rep_set_text_string_v1(privatedata, encoding, OC_ENCODING_RAW_STR, + OC_CHAR_ARRAY_LEN(OC_ENCODING_RAW_STR)); oc_rep_close_object(creds, privatedata); oc_rep_object_array_end_item(creds); @@ -1588,26 +1614,23 @@ oc_obt_provision_pairwise_credentials(const oc_uuid_t *uuid1, const oc_uuid_t *uuid2, oc_obt_status_cb_t cb, void *data) { - oc_credprov_ctx_t *p = oc_memb_alloc(&oc_credprov_ctx_m); - if (!p) { - return -1; - } - if (!oc_obt_is_owned_device(uuid1)) { + if (!oc_obt_is_owned_device(uuid1) || !oc_obt_is_owned_device(uuid2)) { return -1; } - if (!oc_obt_is_owned_device(uuid2)) { + oc_device_t *device1 = oc_obt_get_owned_device_handle(uuid1); + if (device1 == NULL) { return -1; } - oc_device_t *device1 = oc_obt_get_owned_device_handle(uuid1); - if (!device1) { + oc_device_t *device2 = oc_obt_get_owned_device_handle(uuid2); + if (device2 == NULL) { return -1; } - oc_device_t *device2 = oc_obt_get_owned_device_handle(uuid2); - if (!device2) { + oc_credprov_ctx_t *p = oc_memb_alloc(&oc_credprov_ctx_m); + if (p == NULL) { return -1; } @@ -1619,13 +1642,12 @@ oc_obt_provision_pairwise_credentials(const oc_uuid_t *uuid1, oc_tls_select_psk_ciphersuite(); p->switch_dos = switch_dos(device1, OC_DOS_RFPRO, device1_RFPRO, p); - if (!p->switch_dos) { + if (p->switch_dos == NULL) { oc_memb_free(&oc_credprov_ctx_m, p); return -1; } oc_list_add(oc_credprov_ctx_l, p); - return 0; } /* End of provision pairwise credentials sequence */ @@ -1747,12 +1769,14 @@ device_cred(oc_client_response_t *data) oc_rep_object_array_start_item(aclist2); oc_rep_set_object(aclist2, subject); - oc_rep_set_text_string(subject, conntype, "auth-crypt"); + oc_rep_set_text_string_v1(subject, conntype, "auth-crypt", + OC_CHAR_ARRAY_LEN("auth-crypt")); oc_rep_close_object(aclist2, subject); oc_rep_set_array(aclist2, resources); oc_rep_object_array_start_item(resources); - oc_rep_set_text_string(resources, href, "/oic/sec/roles"); + oc_rep_set_text_string_v1(resources, href, "/oic/sec/roles", + OC_CHAR_ARRAY_LEN("/oic/sec/roles")); oc_rep_object_array_end_item(resources); oc_rep_close_array(aclist2, resources); @@ -1895,16 +1919,20 @@ device_CSR(oc_client_response_t *data) oc_rep_object_array_start_item(creds); oc_rep_set_int(creds, credtype, OC_CREDTYPE_CERT); - oc_rep_set_text_string(creds, subjectuuid, "*"); + oc_rep_set_text_string_v1(creds, subjectuuid, "*", OC_CHAR_ARRAY_LEN("*")); oc_rep_set_object(creds, publicdata); oc_rep_set_text_string(publicdata, data, (const char *)cert_pem); - oc_rep_set_text_string(publicdata, encoding, OC_ENCODING_PEM_STR); + oc_rep_set_text_string_v1(publicdata, encoding, OC_ENCODING_PEM_STR, + OC_CHAR_ARRAY_LEN(OC_ENCODING_PEM_STR)); oc_rep_close_object(creds, publicdata); if (p->roles) { - oc_rep_set_text_string(creds, credusage, OC_CREDUSAGE_ROLE_CERT_STR); + oc_rep_set_text_string_v1(creds, credusage, OC_CREDUSAGE_ROLE_CERT_STR, + OC_CHAR_ARRAY_LEN(OC_CREDUSAGE_ROLE_CERT_STR)); } else { - oc_rep_set_text_string(creds, credusage, OC_CREDUSAGE_IDENTITY_CERT_STR); + oc_rep_set_text_string_v1( + creds, credusage, OC_CREDUSAGE_IDENTITY_CERT_STR, + OC_CHAR_ARRAY_LEN(OC_CREDUSAGE_IDENTITY_CERT_STR)); } oc_rep_object_array_end_item(creds); oc_rep_close_array(root, creds); @@ -1967,15 +1995,19 @@ device_RFPRO(int status, void *data) oc_rep_object_array_start_item(creds); oc_rep_set_int(creds, credtype, OC_CREDTYPE_CERT); - oc_rep_set_text_string(creds, subjectuuid, "*"); + oc_rep_set_text_string_v1(creds, subjectuuid, "*", + OC_CHAR_ARRAY_LEN("*")); oc_rep_set_object(creds, publicdata); - oc_rep_set_text_string(publicdata, data, - oc_string(root->publicdata.data)); - oc_rep_set_text_string(publicdata, encoding, OC_ENCODING_PEM_STR); + oc_rep_set_text_string_v1(publicdata, data, + oc_string(root->publicdata.data), + oc_string_len(root->publicdata.data)); + oc_rep_set_text_string_v1(publicdata, encoding, OC_ENCODING_PEM_STR, + OC_CHAR_ARRAY_LEN(OC_ENCODING_PEM_STR)); oc_rep_close_object(creds, publicdata); - oc_rep_set_text_string(creds, credusage, OC_CREDUSAGE_TRUSTCA_STR); + oc_rep_set_text_string_v1(creds, credusage, OC_CREDUSAGE_TRUSTCA_STR, + OC_CHAR_ARRAY_LEN(OC_CREDUSAGE_TRUSTCA_STR)); oc_rep_object_array_end_item(creds); oc_rep_close_array(root, creds); @@ -2034,23 +2066,22 @@ int oc_obt_provision_role_certificate(oc_role_t *roles, const oc_uuid_t *uuid, oc_obt_status_cb_t cb, void *data) { - oc_credprov_ctx_t *p = oc_memb_alloc(&oc_credprov_ctx_m); - if (!p) { - OC_ERR("could not allocate API context"); - return -1; - } - if (!oc_obt_is_owned_device(uuid)) { OC_ERR("device is not owned"); return -1; } - oc_device_t *device = oc_obt_get_owned_device_handle(uuid); - if (!device) { + if (device == NULL) { OC_ERR("could not obtain device handle"); return -1; } + oc_credprov_ctx_t *p = oc_memb_alloc(&oc_credprov_ctx_m); + if (p == NULL) { + OC_ERR("could not allocate API context"); + return -1; + } + p->cb.cb = cb; p->cb.data = data; p->device1 = device; @@ -2062,14 +2093,14 @@ oc_obt_provision_role_certificate(oc_role_t *roles, const oc_uuid_t *uuid, /** 1) get doxm */ const oc_endpoint_t *ep = oc_obt_get_secure_endpoint(device->endpoint); - if (oc_do_get("/oic/sec/doxm", ep, NULL, &supports_cert_creds, HIGH_QOS, p)) { - oc_list_add(oc_credprov_ctx_l, p); - return 0; + if (!oc_do_get("/oic/sec/doxm", ep, NULL, &supports_cert_creds, HIGH_QOS, + p)) { + oc_memb_free(&oc_credprov_ctx_m, p); + return -1; } - oc_memb_free(&oc_credprov_ctx_m, p); - - return -1; + oc_list_add(oc_credprov_ctx_l, p); + return 0; } /* @@ -2085,17 +2116,17 @@ int oc_obt_provision_identity_certificate(const oc_uuid_t *uuid, oc_obt_status_cb_t cb, void *data) { - oc_credprov_ctx_t *p = oc_memb_alloc(&oc_credprov_ctx_m); - if (!p) { + if (!oc_obt_is_owned_device(uuid)) { return -1; } - if (!oc_obt_is_owned_device(uuid)) { + oc_device_t *device = oc_obt_get_owned_device_handle(uuid); + if (device == NULL) { return -1; } - oc_device_t *device = oc_obt_get_owned_device_handle(uuid); - if (!device) { + oc_credprov_ctx_t *p = oc_memb_alloc(&oc_credprov_ctx_m); + if (p == NULL) { return -1; } @@ -2109,14 +2140,13 @@ oc_obt_provision_identity_certificate(const oc_uuid_t *uuid, /** 1) get doxm */ const oc_endpoint_t *ep = oc_obt_get_secure_endpoint(device->endpoint); - if (oc_do_get("/oic/sec/doxm", ep, NULL, &supports_cert_creds, HIGH_QOS, p)) { - oc_list_add(oc_credprov_ctx_l, p); - return 0; + if (!oc_do_get("/oic/sec/doxm", ep, NULL, &supports_cert_creds, HIGH_QOS, + p)) { + oc_memb_free(&oc_credprov_ctx_m, p); + return -1; } - - oc_memb_free(&oc_credprov_ctx_m, p); - - return -1; + oc_list_add(oc_credprov_ctx_l, p); + return 0; } static void @@ -2187,10 +2217,12 @@ trustanchor_device_RFPRO(int status, void *response_data) oc_rep_set_object(creds, publicdata); oc_rep_set_text_string(publicdata, data, p->trustanchor); - oc_rep_set_text_string(publicdata, encoding, OC_ENCODING_PEM_STR); + oc_rep_set_text_string_v1(publicdata, encoding, OC_ENCODING_PEM_STR, + OC_CHAR_ARRAY_LEN(OC_ENCODING_PEM_STR)); oc_rep_close_object(creds, publicdata); - oc_rep_set_text_string(creds, credusage, OC_CREDUSAGE_TRUSTCA_STR); + oc_rep_set_text_string_v1(creds, credusage, OC_CREDUSAGE_TRUSTCA_STR, + OC_CHAR_ARRAY_LEN(OC_CREDUSAGE_TRUSTCA_STR)); oc_rep_object_array_end_item(creds); oc_rep_close_array(root, creds); @@ -2250,18 +2282,17 @@ oc_obt_provision_trust_anchor(const char *certificate, size_t certificate_size, const char *subject, const oc_uuid_t *uuid, oc_obt_status_cb_t cb, void *data) { - OC_ERR("oc_obt_provision_trust_anchor"); - oc_trustanchor_ctx_t *p = oc_memb_alloc(&oc_installtrust_ctx_m); - if (!p) { + OC_DBG("oc_obt_provision_trust_anchor"); + if (!oc_obt_is_owned_device(uuid)) { return -1; } - - if (!oc_obt_is_owned_device(uuid)) { + oc_device_t *device = oc_obt_get_owned_device_handle(uuid); + if (device == NULL) { return -1; } - oc_device_t *device = oc_obt_get_owned_device_handle(uuid); - if (!device) { + oc_trustanchor_ctx_t *p = oc_memb_alloc(&oc_installtrust_ctx_m); + if (p == NULL) { return -1; } @@ -2276,15 +2307,14 @@ oc_obt_provision_trust_anchor(const char *certificate, size_t certificate_size, /** 1) check if certificates is supported */ const oc_endpoint_t *ep = oc_obt_get_secure_endpoint(device->endpoint); - if (oc_do_get("/oic/sec/doxm", ep, NULL, &trustanchor_supports_cert_creds, - HIGH_QOS, p)) { - oc_list_add(oc_installtrust_ctx_l, p); - return 0; + if (!oc_do_get("/oic/sec/doxm", ep, NULL, &trustanchor_supports_cert_creds, + HIGH_QOS, p)) { + oc_memb_free(&oc_installtrust_ctx_m, p); + return -1; } - // oc_memb_free(&oc_installtrust_ctx_m, p); - - return -1; + oc_list_add(oc_installtrust_ctx_l, p); + return 0; } #endif /* OC_PKI */ @@ -2295,31 +2325,27 @@ oc_obt_provision_role_wildcard_ace(const oc_uuid_t *subject, const char *role, const char *authority, oc_obt_device_status_cb_t cb, void *data) { - oc_sec_ace_t *ace = NULL; - oc_ace_res_t *res = NULL; - int ret = -1; - - ace = oc_obt_new_ace_for_role(role, authority); - if (!ace) { - goto exit_aceprov_role_wc; + oc_sec_ace_t *ace = oc_obt_new_ace_for_role(role, authority); + if (ace == NULL) { + goto error; } - res = oc_obt_ace_new_resource(ace); - if (!res) { - oc_obt_free_ace(ace); - goto exit_aceprov_role_wc; + oc_ace_res_t *res = oc_obt_ace_new_resource(ace); + if (res == NULL) { + goto error; } oc_obt_ace_resource_set_wc(res, OC_ACE_WC_ALL); oc_obt_ace_add_permission(ace, OC_PERM_RETRIEVE | OC_PERM_UPDATE); - if (oc_obt_provision_ace(subject, ace, cb, data) >= 0) { - ret = 0; - return ret; + if (oc_obt_provision_ace(subject, ace, cb, data) < 0) { + goto error; } + return 0; -exit_aceprov_role_wc: - return ret; +error: + oc_obt_free_ace(ace); + return -1; } /* Provision auth-crypt ACE for the wildcard "*" resource with RW permissions */ @@ -2327,31 +2353,27 @@ int oc_obt_provision_auth_wildcard_ace(const oc_uuid_t *subject, oc_obt_device_status_cb_t cb, void *data) { - oc_sec_ace_t *ace = NULL; - oc_ace_res_t *res = NULL; - int ret = -1; - - ace = oc_obt_new_ace_for_connection(OC_CONN_AUTH_CRYPT); - if (!ace) { - goto exit_aceprov_ac_wc; + oc_sec_ace_t *ace = oc_obt_new_ace_for_connection(OC_CONN_AUTH_CRYPT); + if (ace == NULL) { + return -1; } - res = oc_obt_ace_new_resource(ace); - if (!res) { - oc_obt_free_ace(ace); - goto exit_aceprov_ac_wc; + oc_ace_res_t *res = oc_obt_ace_new_resource(ace); + if (res == NULL) { + goto error; } oc_obt_ace_resource_set_wc(res, OC_ACE_WC_ALL); oc_obt_ace_add_permission(ace, OC_PERM_RETRIEVE | OC_PERM_UPDATE); - if (oc_obt_provision_ace(subject, ace, cb, data) >= 0) { - ret = 0; - return ret; + if (oc_obt_provision_ace(subject, ace, cb, data) < 0) { + goto error; } + return 0; -exit_aceprov_ac_wc: - return ret; +error: + oc_obt_free_ace(ace); + return -1; } /* Provision access-control entries */ @@ -2559,18 +2581,23 @@ provision_ace(int status, void *data) case OC_SUBJECT_CONN: { switch (ace->subject.conn) { case OC_CONN_AUTH_CRYPT: - oc_rep_set_text_string(subject, conntype, "auth-crypt"); + oc_rep_set_text_string_v1(subject, conntype, "auth-crypt", + OC_CHAR_ARRAY_LEN("auth-crypt")); break; case OC_CONN_ANON_CLEAR: - oc_rep_set_text_string(subject, conntype, "anon-clear"); + oc_rep_set_text_string_v1(subject, conntype, "anon-clear", + OC_CHAR_ARRAY_LEN("anon-clear")); break; } } break; case OC_SUBJECT_ROLE: { - oc_rep_set_text_string(subject, role, oc_string(ace->subject.role.role)); + oc_rep_set_text_string_v1(subject, role, + oc_string(ace->subject.role.role), + oc_string_len(ace->subject.role.role)); if (oc_string_len(ace->subject.role.authority) > 0) { - oc_rep_set_text_string(subject, authority, - oc_string(ace->subject.role.authority)); + oc_rep_set_text_string_v1(subject, authority, + oc_string(ace->subject.role.authority), + oc_string_len(ace->subject.role.authority)); } } break; default: @@ -2583,17 +2610,18 @@ provision_ace(int status, void *data) while (res != NULL) { oc_rep_object_array_start_item(resources); if (oc_string_len(res->href) > 0) { - oc_rep_set_text_string(resources, href, oc_string(res->href)); + oc_rep_set_text_string_v1(resources, href, oc_string(res->href), + oc_string_len(res->href)); } else { switch (res->wildcard) { case OC_ACE_WC_ALL_SECURED: - oc_rep_set_text_string(resources, wc, "+"); + oc_rep_set_text_string_v1(resources, wc, "+", OC_CHAR_ARRAY_LEN("+")); break; case OC_ACE_WC_ALL_PUBLIC: - oc_rep_set_text_string(resources, wc, "-"); + oc_rep_set_text_string_v1(resources, wc, "-", OC_CHAR_ARRAY_LEN("-")); break; case OC_ACE_WC_ALL: - oc_rep_set_text_string(resources, wc, "*"); + oc_rep_set_text_string_v1(resources, wc, "*", OC_CHAR_ARRAY_LEN("*")); break; default: break; @@ -2623,17 +2651,16 @@ int oc_obt_provision_ace(const oc_uuid_t *uuid, oc_sec_ace_t *ace, oc_obt_device_status_cb_t cb, void *data) { - oc_acl2prov_ctx_t *r = (oc_acl2prov_ctx_t *)oc_memb_alloc(&oc_acl2prov_ctx_m); - if (!r) { + if (!oc_obt_is_owned_device(uuid)) { return -1; } - - if (!oc_obt_is_owned_device(uuid)) { + oc_device_t *device = oc_obt_get_owned_device_handle(uuid); + if (device == NULL) { return -1; } - oc_device_t *device = oc_obt_get_owned_device_handle(uuid); - if (!device) { + oc_acl2prov_ctx_t *r = (oc_acl2prov_ctx_t *)oc_memb_alloc(&oc_acl2prov_ctx_m); + if (r == NULL) { return -1; } @@ -2645,14 +2672,12 @@ oc_obt_provision_ace(const oc_uuid_t *uuid, oc_sec_ace_t *ace, oc_tls_select_psk_ciphersuite(); r->switch_dos = switch_dos(device, OC_DOS_RFPRO, provision_ace, r); - if (!r->switch_dos) { - free_ace(ace); + if (r->switch_dos == NULL) { oc_memb_free(&oc_acl2prov_ctx_m, r); return -1; } oc_list_add(oc_acl2prov_ctx_l, r); - return 0; } /* End of provision ACE sequence */ @@ -2903,7 +2928,6 @@ oc_obt_retrieve_creds(const oc_uuid_t *uuid, oc_obt_creds_cb_t cb, void *data) } oc_memb_free(&oc_credret_ctx_m, r); - return 0; } @@ -3023,7 +3047,6 @@ oc_obt_delete_cred_by_credid(const oc_uuid_t *uuid, int credid, } oc_list_add(oc_creddel_ctx_l, p); - return 0; } diff --git a/security/oc_oscore_context.c b/security/oc_oscore_context.c index 970d5f00cc..ac9557a5e6 100644 --- a/security/oc_oscore_context.c +++ b/security/oc_oscore_context.c @@ -141,9 +141,14 @@ oc_oscore_add_context(size_t device, const char *senderid, const char *recipientid, uint64_t ssn, const char *desc, void *cred_entry, bool from_storage) { - oc_oscore_context_t *ctx = (oc_oscore_context_t *)oc_memb_alloc(&ctx_s); + if ((!senderid && !recipientid) || !cred_entry) { + OC_ERR("oc_oscore_add_context: invalid parameters"); + return NULL; + } - if (!ctx || (!senderid && !recipientid) || !cred_entry) { + oc_oscore_context_t *ctx = (oc_oscore_context_t *)oc_memb_alloc(&ctx_s); + if (ctx == NULL) { + OC_ERR("oc_oscore_add_context: no memory to add new context"); return NULL; } diff --git a/security/oc_oscore_engine.c b/security/oc_oscore_engine.c index d25de86af7..02ef410caa 100644 --- a/security/oc_oscore_engine.c +++ b/security/oc_oscore_engine.c @@ -182,7 +182,7 @@ oscore_parse_message(oc_message_t *message) const uint8_t *key = oscore_ctx->recvkey; uint8_t AAD[OSCORE_AAD_MAX_LEN]; uint8_t AAD_len = 0; - uint8_t nonce[OSCORE_AEAD_NONCE_LEN]; + uint8_t nonce[OSCORE_AEAD_NONCE_LEN] = { 0 }; /* If received Partial IV in message */ if (oscore_pkt.piv_len > 0) { /* If message is request */