rpcserver: common: Fix buffer overflow in handle_client

src/rpcserver/common.c

@@ -100,11 +100,13 @@ void safe_free(void **ptr) {
     *ptr = NULL;
 }
 
-bool receive_message(int sockfd, char *buf, size_t *size) {
+bool receive_message(int sockfd, char **buf, size_t *size) {
     bool ret = false;
-    recv(sockfd, size, sizeof(size_t), 0);
-    CHECK(*size != 0);
-    CHECK(recvall(sockfd, buf, *size));
+    CHECK(sizeof(size_t) == recv(sockfd, size, sizeof(size_t), 0));
+    CHECK(*size > 0);
+    *buf = (char *) malloc(*size * sizeof(char));
+    CHECK(NULL != *buf);
+    CHECK(recvall(sockfd, *buf, *size));
     ret = true;
 error:
     return ret;

src/rpcserver/common.h

@@ -55,7 +55,7 @@ bool send_message(int sockfd, const uint8_t *buf, size_t len);
 
 bool send_response(int sockfd, ProtobufCMessage *resp);
 
-bool receive_message(int sockfd, char *buf, size_t *size);
+bool receive_message(int sockfd, char **buf, size_t *size);
 
 void safe_free(void **ptr);
 

src/rpcserver/rpcserver.c

@@ -720,11 +720,13 @@ void handle_client(int sockfd) {
 
     while (true) {
         Rpc__Command *cmd;
+        char *recv_buff = NULL;
         message_size = 0;
-        CHECK(receive_message(sockfd, (char *) &buffer, &message_size))
+        CHECK(receive_message(sockfd, &recv_buff, &message_size))
 
         TRACE("recv");
-        cmd = rpc__command__unpack(NULL, message_size, buffer);
+        cmd = rpc__command__unpack(NULL, message_size, (uint8_t *) recv_buff);
+        CHECK(cmd != NULL);
         TRACE("client fd: %d, cmd type: %d", sockfd, cmd->type_case);
         CHECK(cmd->magic == MAGIC);
 
@@ -785,6 +787,7 @@ void handle_client(int sockfd) {
         }
         }
         rpc__command__free_unpacked(cmd, NULL);
+        safe_free((void **) &recv_buff);
     }
 
 error: