From 191d4f9a428aae3f135c537a7ebc514eb6843e28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20S=2E=20Montero?= Date: Thu, 7 May 2009 22:16:03 +0000 Subject: [PATCH] Safer insert strings in the DB git-svn-id: http://svn.opennebula.org/one/trunk@515 3034c82b-c49b-4eb3-8279-a7acafdc01c0 --- src/host/Host.cc | 60 +++++++++++++++++++++++++++++++---- src/vm/History.cc | 58 ++++++++++++++++++++++++++++++--- src/vm/VirtualMachine.cc | 11 ++++++- src/vnm/VirtualNetwork.cc | 22 +++++++++++-- src/vnm/VirtualNetworkPool.cc | 13 ++++++-- 5 files changed, 147 insertions(+), 17 deletions(-) diff --git a/src/host/Host.cc b/src/host/Host.cc index 54cfb4b404..7f791ac47a 100644 --- a/src/host/Host.cc +++ b/src/host/Host.cc @@ -199,10 +199,15 @@ int Host::insert(SqliteDB *db) int Host::update(SqliteDB *db) { ostringstream oss; - int rc; - - int managed_i = managed?1:0; + + int rc; + int managed_i = managed?1:0; + char * sql_hostname; + char * sql_im_mad_name; + char * sql_tm_mad_name; + char * sql_vmm_mad_name; + //Update template. rc = host_template.update(db); @@ -221,21 +226,62 @@ int Host::update(SqliteDB *db) return rc; } + sql_hostname = sqlite3_mprintf("%q",hostname.c_str()); + + if ( sql_hostname == 0 ) + { + goto error_hostname; + } + + sql_im_mad_name = sqlite3_mprintf("%q",im_mad_name.c_str()); + + if ( sql_im_mad_name == 0 ) + { + goto error_im; + } + + sql_tm_mad_name = sqlite3_mprintf("%q",tm_mad_name.c_str()); + + if ( sql_tm_mad_name == 0 ) + { + goto error_tm; + } + + sql_vmm_mad_name = sqlite3_mprintf("%q",vmm_mad_name.c_str()); + + if ( sql_vmm_mad_name == 0 ) + { + goto error_vmm; + } // Construct the SQL statement to Insert or Replace (effectively, update) oss << "INSERT OR REPLACE INTO " << table << " "<< db_names <<" VALUES ("<< oid << "," << - "'" << hostname << "'," << + "'" << sql_hostname << "'," << state << "," << - "'" << im_mad_name << "'," << - "'" << vmm_mad_name << "'," << - "'" << tm_mad_name << "'," << + "'" << sql_im_mad_name << "'," << + "'" << sql_vmm_mad_name << "'," << + "'" << sql_tm_mad_name << "'," << last_monitored << "," << managed_i << ")"; rc = db->exec(oss); + sqlite3_free(sql_hostname); + sqlite3_free(sql_im_mad_name); + sqlite3_free(sql_im_mad_name); + sqlite3_free(sql_vmm_mad_name); + return rc; + +error_vmm: + sqlite3_free(sql_tm_mad_name); +error_tm: + sqlite3_free(sql_im_mad_name); +error_im: + sqlite3_free(sql_hostname); +error_hostname: + return -1; } /* -------------------------------------------------------------------------- */ diff --git a/src/vm/History.cc b/src/vm/History.cc index d8e75086a1..3e494ddb61 100644 --- a/src/vm/History.cc +++ b/src/vm/History.cc @@ -138,21 +138,55 @@ void History::non_persistent_data() int History::insert(SqliteDB * db) { ostringstream oss; - int rc; + + int rc; + char * sql_hostname; + char * sql_vm_dir; + char * sql_vmm_mad_name; + char * sql_tm_mad_name; + if (seq == -1) { return 0; } + + sql_hostname = sqlite3_mprintf("%q",hostname.c_str()); + + if ( sql_hostname == 0 ) + { + goto error_hostname; + } + + sql_vm_dir = sqlite3_mprintf("%q",vm_dir.c_str()); + + if ( sql_vm_dir == 0 ) + { + goto error_vm_dir; + } + + sql_vmm_mad_name = sqlite3_mprintf("%q",vmm_mad_name.c_str()); + + if ( sql_vmm_mad_name == 0 ) + { + goto error_vmm; + } + + sql_tm_mad_name = sqlite3_mprintf("%q",tm_mad_name.c_str()); + + if ( sql_tm_mad_name == 0 ) + { + goto error_tm; + } oss << "INSERT OR REPLACE INTO " << table << " "<< db_names <<" VALUES ("<< oid << "," << seq << "," << - "'" << hostname << "',"<< - "'" << vm_dir << "'," << + "'" << sql_hostname << "',"<< + "'" << sql_vm_dir << "'," << hid << "," << - "'" << vmm_mad_name << "'," << - "'" << tm_mad_name << "'," << + "'" << sql_vmm_mad_name << "'," << + "'" << sql_tm_mad_name << "'," << stime << "," << etime << "," << prolog_stime << "," << @@ -165,7 +199,21 @@ int History::insert(SqliteDB * db) rc = db->exec(oss); + sqlite3_free(sql_hostname); + sqlite3_free(sql_vm_dir); + sqlite3_free(sql_vmm_mad_name); + sqlite3_free(sql_tm_mad_name); + return rc; + +error_tm: + sqlite3_free(sql_vmm_mad_name); +error_vmm: + sqlite3_free(sql_vm_dir); +error_vm_dir: + sqlite3_free(sql_hostname); +error_hostname: + return -1; } /* -------------------------------------------------------------------------- */ diff --git a/src/vm/VirtualMachine.cc b/src/vm/VirtualMachine.cc index 8b43e8719e..1c9607b0dc 100644 --- a/src/vm/VirtualMachine.cc +++ b/src/vm/VirtualMachine.cc @@ -354,6 +354,13 @@ int VirtualMachine::update(SqliteDB * db) ostringstream oss; int rc; + char * sql_deploy_id = sqlite3_mprintf("%q",deploy_id.c_str()); + + if ( sql_deploy_id == 0 ) + { + return -1; + } + oss << "INSERT OR REPLACE INTO " << table << " "<< db_names <<" VALUES ("<< oid << "," << uid << "," << @@ -363,12 +370,14 @@ int VirtualMachine::update(SqliteDB * db) lcm_state << "," << stime << "," << etime << "," << - "'" << deploy_id << "'," << + "'" << sql_deploy_id << "'," << memory << "," << cpu << "," << net_tx << "," << net_rx << ")"; + sqlite3_free(sql_deploy_id); + rc = db->exec(oss); return rc; diff --git a/src/vnm/VirtualNetwork.cc b/src/vnm/VirtualNetwork.cc index ba83c16edc..29667ddacf 100644 --- a/src/vnm/VirtualNetwork.cc +++ b/src/vnm/VirtualNetwork.cc @@ -356,16 +356,34 @@ int VirtualNetwork::update(SqliteDB * db) { ostringstream oss; int rc; + + char * sql_name = sqlite3_mprintf("%q",name.c_str()); + + if ( sql_name == 0 ) + { + return -1; + } + + char * sql_bridge = sqlite3_mprintf("%q",bridge.c_str()); + + if ( sql_bridge == 0 ) + { + sqlite3_free(sql_name); + return -1; + } oss << "INSERT OR REPLACE INTO " << table << " "<< db_names <<" VALUES ("<< oid << "," << uid << "," << - "'" << name << "'," << + "'" << sql_name << "'," << type << "," << - "'" << bridge << "')"; + "'" << sql_bridge << "')"; rc = db->exec(oss); + sqlite3_free(sql_name); + sqlite3_free(sql_bridge); + return rc; } diff --git a/src/vnm/VirtualNetworkPool.cc b/src/vnm/VirtualNetworkPool.cc index dccca0236c..da177811ad 100644 --- a/src/vnm/VirtualNetworkPool.cc +++ b/src/vnm/VirtualNetworkPool.cc @@ -153,12 +153,21 @@ VirtualNetwork * VirtualNetworkPool::get(const string& name, bool lock) int oid; int rc; - + + char * sql_name = sqlite3_mprintf("%q",name.c_str()); + + if ( sql_name == 0 ) + { + return 0; + } + oss << "SELECT oid FROM " << VirtualNetwork::table << " WHERE name = '" - << name << "'"; + << sql_name << "'"; rc = db->exec(oss, select_name_cb, (void *) (&oid)); + sqlite3_free(sql_name); + if (rc != 0) { return 0;