commit 3daf7a1ca0e317225e3c0cf821267e75726eabe8
author Manojkiran Eda <manojkiran.eda@gmail.com> Wed Apr 17 20:33:44 2024 +0530
committer Manojkiran Eda <manojkiran.eda@gmail.com> Mon Apr 22 11:11:51 2024 +0530
tree adb88e86a7036718f315fe5e3118b2219e55735b
parent 963c0fdf1aef305f266e00b2321fc244f89d0fa7

libpldmresponder: fix a potential pldm crash

In the current state, pldm does create the sensor/effecter even in the
absence of the underlying dbus resource. There is a bug in the responder
code due to which we emplace an empty dbus value map into the handler
with a sensor ID. And if the remote PLDM endpoint queries for the state
of the sensor, pldm would crash since it tries to read content from the
empty dbus value map. This commit would fix the crash by adding
necessary bound checks.

Testing:
1. Unit tests passed.
2. Functionally verified the fix by giving a dummy dbus object path and
making sure that the sensor/effecter is not created & also ensured that
pldm does not crash.

Change-Id: I5fb06677f6ae1bd74f9ec741b311f59737caf79d
Signed-off-by: Manojkiran Eda <manojkiran.eda@gmail.com>

libpldmresponder/platform_state_sensor.hpp

diff --git a/libpldmresponder/platform_state_sensor.hpp b/libpldmresponder/platform_state_sensor.hpp
index 12e4b04..e6f7629 100644
--- a/libpldmresponder/platform_state_sensor.hpp
+++ b/libpldmresponder/platform_state_sensor.hpp
@@ -147,18 +147,27 @@
         const auto& [dbusMappings, dbusValMaps] = handler.getDbusObjMaps(
             sensorId, pldm::responder::pdr_utils::TypeId::PLDM_SENSOR_ID);
 
+        if (dbusMappings.empty() || dbusValMaps.empty())
+        {
+            error("dbusMappings for sensor id : {SENSOR_ID} is missing",
+                  "SENSOR_ID", sensorId);
+            return PLDM_ERROR;
+        }
         pldm::responder::pdr_utils::EventStates sensorCacheforSensor{};
         if (sensorCache.contains(sensorId))
         {
             sensorCacheforSensor = sensorCache.at(sensorId);
         }
         stateField.clear();
-        for (std::size_t i{0}; i < sensorRearmCnt; i++)
+        for (std::size_t offset{0};
+             offset < sensorRearmCnt && offset < dbusMappings.size() &&
+             offset < dbusValMaps.size();
+             offset++)
         {
-            auto& dbusMapping = dbusMappings[i];
+            auto& dbusMapping = dbusMappings[offset];
 
             uint8_t sensorEvent = getStateSensorEventState<DBusInterface>(
-                dBusIntf, dbusValMaps[i], dbusMapping);
+                dBusIntf, dbusValMaps[offset], dbusMapping);
 
             uint8_t previousState = PLDM_SENSOR_UNKNOWN;
 
@@ -166,16 +175,16 @@
             // get_state_sensor_reading on this sensor, set the previous state
             // as the current state
 
-            if (sensorCacheforSensor.at(i) == PLDM_SENSOR_UNKNOWN)
+            if (sensorCacheforSensor.at(offset) == PLDM_SENSOR_UNKNOWN)
             {
                 previousState = sensorEvent;
-                handler.updateSensorCache(sensorId, i, previousState);
+                handler.updateSensorCache(sensorId, offset, previousState);
             }
             else
             {
                 // sensor cache is not empty, so get the previous state from
                 // the sensor cache
-                previousState = sensorCacheforSensor[i];
+                previousState = sensorCacheforSensor[offset];
             }
             uint8_t opState = PLDM_SENSOR_ENABLED;
             if (sensorEvent == PLDM_SENSOR_UNKNOWN)