[Libreoffice-commits] online.git: kit/Kit.cpp

[Ashod Nakashian]

 kit/Kit.cpp |   61 +++++++++++++++++++++++++++++++++---------------------------
 1 file changed, 34 insertions(+), 27 deletions(-)

New commits:
commit 7f8ffcfab5a774d0a480b58f594bf5e9fe698e6d
Author: Ashod Nakashian <ashod.nakashian at collabora.co.uk>
Date:   Thu Jan 19 20:50:19 2017 -0500

    wsd: check for malformed callback messages
    
    Change-Id: I991480ea0f7d588c2e9a4e31eaada23fc1da1ffa
    Reviewed-on: https://gerrit.libreoffice.org/33419
    Reviewed-by: Ashod Nakashian <ashnakash at gmail.com>
    Tested-by: Ashod Nakashian <ashnakash at gmail.com>

diff --git a/kit/Kit.cpp b/kit/Kit.cpp
index fa04207..4d862de 100644
--- a/kit/Kit.cpp
+++ b/kit/Kit.cpp
@@ -1382,42 +1382,49 @@ private:
                 }
                 else if (tokens[0] == "callback")
                 {
-                    int viewId = std::stoi(tokens[1]); // -1 means broadcast
-                    int type = std::stoi(tokens[2]);
+                    if (tokens.size() >= 3)
+                    {
+                        int viewId = std::stoi(tokens[1]); // -1 means broadcast
+                        int type = std::stoi(tokens[2]);
 
-                    // payload is the rest of the message
-                    const auto offset = tokens[0].length() + tokens[1].length() + tokens[2].length() + 3; // + delims
-                    const std::string payload(input.data() + offset, input.size() - offset);
+                        // payload is the rest of the message
+                        const auto offset = tokens[0].length() + tokens[1].length() + tokens[2].length() + 3; // + delims
+                        const std::string payload(input.data() + offset, input.size() - offset);
 
-                    // Forward the callback to the same view, demultiplexing is done by the LibreOffice core.
-                    // TODO: replace with a map to be faster.
-                    bool isFound = false;
-                    for (auto& it : _sessions)
-                    {
-                        auto session = it.second;
-                        if (session && ((session->getViewId() == viewId) || (viewId == -1)))
+                        // Forward the callback to the same view, demultiplexing is done by the LibreOffice core.
+                        // TODO: replace with a map to be faster.
+                        bool isFound = false;
+                        for (auto& it : _sessions)
                         {
-                            if (!it.second->isCloseFrame())
-                            {
-                                isFound = true;
-                                session->loKitCallback(type, payload);
-                            }
-                            else
+                            auto session = it.second;
+                            if (session && ((session->getViewId() == viewId) || (viewId == -1)))
                             {
-                                LOG_ERR("Session-thread of session [" << session->getId() << "] for view [" <<
-                                        viewId << "] is not running. Dropping [" << LOKitHelper::kitCallbackTypeToString(type) <<
-                                        "] payload [" << payload << "].");
+                                if (!it.second->isCloseFrame())
+                                {
+                                    isFound = true;
+                                    session->loKitCallback(type, payload);
+                                }
+                                else
+                                {
+                                    LOG_ERR("Session-thread of session [" << session->getId() << "] for view [" <<
+                                            viewId << "] is not running. Dropping [" << LOKitHelper::kitCallbackTypeToString(type) <<
+                                            "] payload [" << payload << "].");
+                                }
+
+                                break;
                             }
+                        }
 
-                            break;
+                        if (!isFound)
+                        {
+                            LOG_WRN("Document::ViewCallback. Session [" << viewId <<
+                                    "] is no longer active to process [" << LOKitHelper::kitCallbackTypeToString(type) <<
+                                    "] [" << payload << "] message to Master Session.");
                         }
                     }
-
-                    if (!isFound)
+                    else
                     {
-                        LOG_WRN("Document::ViewCallback. Session [" << viewId <<
-                                "] is no longer active to process [" << LOKitHelper::kitCallbackTypeToString(type) <<
-                                "] [" << payload << "] message to Master Session.");
+                        LOG_ERR("Invalid callback message: [" << LOOLProtocol::getAbbreviatedMessage(input) << "].");
                     }
                 }
                 else