Source Code Auditing

//Original Source By: [ REDACTED STUDENT NAME ]
//Date: 23/3/2016

//A simple program for managing data in an array
//I DARE YOU TO TRY AND BREAK THIS
//I give permission for this to be modified, reused and distributed however you like
//- [ REDACTED ]

// This has been modified to be (more) insecure for the purpose of the COMP9447 exam
// by Jordan Brown

// This has been modified again by thoth + alyb

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define min(X,Y) ((X) < (Y) ? (X) : (Y))
#define max(X,Y) ((X) > (Y) ? (X) : (Y))

#define STRING_LENGTH 256
#define NUMBER_LENGTH 8

#define STRCOMP_SUCCESS 0

#define COM_ERROR 0
#define COM_EXIT 1
#define COM_NEW 2
#define COM_GET 3
#define COM_DEL 4
#define COM_SET 5
#define COM_HELP 6
#define COM_SHOW 7
#define COM_SUBSTR 8

#define TRUE 1
#define FALSE 0
#define NUM_ONLY 2

#define INVALID_VALUE -1

#define MAX_ARRAY_SIZE 1024


void newCommand (void);
void clearString (char* string);
int validCharacter (char character);
int determineCommand (char* command);
void printHelp (void);
int validCommandString (char* inputString);
void commandNew (int* arraySize, int* createNewPrevValue, int* createNew, int newSize, int* dataArray);
void commandDel (int* dataArray);
void commandSet (int newData, int position, int* dataArray, int arraySize);
void commandGet (int position, int* dataArray, int arraySize);
void commandShow (int* dataArray, int arraySize);
void commandSubstring (int* dataArray, unsigned int arraySize, unsigned int start, unsigned int end);

int main (int argr, char ** argv) {

    //only run once (program start up)
    char inputString[STRING_LENGTH] = "";
    char commandString[STRING_LENGTH] = "";
    char number1String[STRING_LENGTH] = "";
    char number2String[STRING_LENGTH] = "";
    int stopProgram = FALSE;
    int commandNumber = COM_ERROR;
    int spacePos1 = INVALID_VALUE;
    int spacePos2 = INVALID_VALUE;
    int commandArg1 = INVALID_VALUE;
    int commandArg2 = INVALID_VALUE;
    int validNum1 = FALSE;
    int validNum2 = FALSE;
    int validInput = FALSE;

    //for the new array function
    int createNew = FALSE;
    int createNewPrevValue = 0;

    int dataArray[MAX_ARRAY_SIZE];
    int arraySize = 0;

    printf("Welcome the the array program\n");
    printf("Please type a command or type 'help'\n");

    //run while the user does not exit
    while (stopProgram == FALSE) {
        clearString(inputString);
        clearString(commandString);
        clearString(number1String);
        clearString(number2String);

        validInput = FALSE;
        spacePos1 = INVALID_VALUE;
        spacePos2 = INVALID_VALUE;
        validNum1 = FALSE;
        validNum2 = FALSE;

        //get input
        newCommand();
        fgets(inputString,STRING_LENGTH - 1,stdin);
        inputString[strlen(inputString) - 1] = '\0';

        //check for valid input
        //check if input uses correct characters
        validInput = validCommandString(inputString);
        if (validInput == FALSE) {
            strcpy(commandString, "INVALID CHARACTERS");
            continue;
        }

            //find position of spaces
            int c;
            for (c = 0; c < strlen(inputString); c++) {
                if (inputString[c] == ' ') {
                    if (spacePos1 == INVALID_VALUE) {
                        spacePos1 = c;
                    } else if (spacePos2 == INVALID_VALUE) {
                        spacePos2 = c;
                    } else { //too many spaces, throw error
                        strcpy(commandString, "TOO MANY ARGUMENTS");
                        validInput = FALSE;
                        break;
                    }
                }
            }

            //ensure position of spaces is correct
            if (spacePos1 == 0) {//cannot have space in first position
                validInput = FALSE;
                strcpy(commandString, "FORMATING ERROR");
                continue;
            } else if (spacePos2 == spacePos1 + 1) {//two spaces in a row
                validInput = FALSE;
                strcpy(commandString, "FORMATING ERROR");
                continue;
            } else if (spacePos1 == strlen(inputString) - 1 || spacePos2 == strlen(inputString) - 1) {//spaces at end of command or no command
                validInput = FALSE;
                strcpy(commandString, "FORMATTING ERROR");
                continue;
            }

            if (spacePos1 == INVALID_VALUE) {//command without arguments
                strcpy(commandString, inputString); //copy into result
            } else {
                int n;
                for (n = 0; n < spacePos1; n++) { //copy command string
                    commandString[n] = inputString[n];
                }
                if (spacePos2 != INVALID_VALUE){ //two arguments
                    //copy numbers into appropriate number strings
                    //int n = spacePos1 + 1;
                    for (n = spacePos1 + 1; n < spacePos2; n++) {//copy arg1
                        number1String[n - spacePos1 - 1] = inputString[n];
                    }
                    for (n = spacePos2 + 1; n < strlen(inputString); n++) {//copy arg2
                        number2String[n - spacePos2 - 1] = inputString[n];
                    }
                } else if (spacePos1 != INVALID_VALUE) {//only 1 arg
                    for (n = spacePos1 + 1; n < strlen(inputString); n++) {//copy arg1
                        number1String[n - spacePos1 - 1] = inputString[n];
                        //printf("added num\n");
                    }
                }

            }
            //if the arg number is valid, convert it to number
            char* resultText;
                commandArg1 = (int) strtol(number1String, &resultText, 10);
                commandArg2 = (int) strtol(number2String, &resultText, 10);


        //determine command code
        commandNumber = determineCommand(commandString);

        //execute command
        switch (commandNumber) {
            case COM_NEW: //printf("Creating new array\n");
                commandNew(&arraySize, &createNewPrevValue, &createNew, commandArg1, dataArray);
            break;

            case COM_GET: //printf("Getting data\n");
                commandGet (commandArg1, dataArray, arraySize);
            break;

            case COM_SUBSTR: //printf("Deleting data\n");
                commandSubstring(dataArray, arraySize, commandArg1, commandArg2);
            break;

            case COM_DEL: //printf("Deleting data\n");
                commandDel(dataArray);
            break;

            case COM_ERROR:
                printf("<ERROR> INVALID COMMAND '%s'\n",commandString);
                stopProgram = TRUE;
            break;

            case COM_EXIT: printf("Exiting Program\n");
                stopProgram = TRUE;
            break;

            case COM_HELP:
                printHelp();
            break;

            case COM_SET:
                commandSet(commandArg2, commandArg1, dataArray, arraySize);
            break;

            case COM_SHOW:
                commandShow(dataArray, arraySize);
            break;
        }
    }

    return EXIT_SUCCESS;
}

void newCommand (void) {
    //prints out the symbol signifying user input
    printf(">> ");
}

void clearString (char* string) {
    //sets the chars of array to string terminator
    int i;
    for (i = 0; i< sizeof(string); i++) {
        string[i] = '\0';
    }
}

int validCharacter (char character) {
    //check to see if the character inputted is valid
    int valid = FALSE;

    if ((character >= 'a' && character <= 'z') || character == ' ') {
        valid = TRUE;
    } else if (character >= '0' && character <= '9') {
        valid = NUM_ONLY;
    }

    return valid;
}

int determineCommand (char* command) {
    //determine command inputted based on string
    int comNum = COM_ERROR;

    if (strcmp(command, "exit") == STRCOMP_SUCCESS) {
        comNum = COM_EXIT;
    } else if (strcmp(command, "new") == STRCOMP_SUCCESS) {
        comNum = COM_NEW;
    } else if (strcmp(command, "get") == STRCOMP_SUCCESS) {
        comNum = COM_GET;
    } else if (strcmp(command, "del") == STRCOMP_SUCCESS) {
        comNum = COM_DEL;
    } else if (strcmp(command, "set") == STRCOMP_SUCCESS) {
        comNum = COM_SET;
    } else if (strcmp(command, "substr") == STRCOMP_SUCCESS) {
        comNum = COM_SUBSTR;
    } else if (strcmp(command, "help") == STRCOMP_SUCCESS) {
        comNum = COM_HELP;
    } else if (strcmp(command, "show") == STRCOMP_SUCCESS) {
        comNum = COM_SHOW;
    }

    return comNum;
}

void printHelp (void) {
    printf("============== Array Program Help Data ==============\n");
    printf("Command Syntax | Description\n");
    printf("new <length> | Create array of <length> size\n");
    printf("get <location> | Prints data stored at <location\n");
    printf("set <location> <data> | Sets data at <location> to <data>\n");
    printf("substr <start> <end> | Sets data at <location> to <data>\n");
    printf("show | Prints all data stored\n");
    printf("del  | Resets all data to NULL\n");
    printf("exit | Closes program and discards data\n");
    printf("==================== END OF HELP ====================\n");
}

int validCommandString (char* inputString) {
    int valid = TRUE;
    int i;
    for (i = 0; i< strlen(inputString); i++) {
        if (validCharacter(inputString[i]) == FALSE) { //if this character is not valid
            valid = FALSE;
            printf("<< not valid: '");
            printf(inputString);
            printf("'\n");
            break;
        }
    }
    return valid;
}

void commandNew (int* arraySize, int* createNewPrevValue, int* createNew, int newSize, int* dataArray) {
        if (*arraySize == 0 && newSize > 0 && newSize <= MAX_ARRAY_SIZE) {
            *arraySize = newSize;
            printf("Sussessfully created new array of length %d\n", newSize);
        } else if (newSize > 0 && newSize <= MAX_ARRAY_SIZE) {
            if (*createNew == TRUE && *createNewPrevValue == newSize) {
                *arraySize = *createNewPrevValue;
                *createNew = FALSE;
                commandDel(dataArray);
                printf("Resized array to length %d\n", *createNewPrevValue);

            } else {
                printf("This will resize the array to length %d and clear all data in the array\n", newSize);
                printf("To confirm, input command again\n");
                *createNewPrevValue = newSize;
                *createNew = TRUE;
            }
        } else {
            printf("<ERROR> ARRAY SIZE OUT OF BOUNDS (MAX IS 1024)\n");
        }
}

void commandDel(int* dataArray) {
    int i;
    for (i = 0; i< MAX_ARRAY_SIZE; i++) {
        dataArray[i] = 0;
    }
    printf("Array cleared\n");
}


void commandSet (int newData, int position, int* dataArray, int arraySize) {
        if (arraySize > 0 && position < arraySize) {
            dataArray[position] = newData;
            printf("Position %d set to %d\n", position, newData);
        } else {
            if (arraySize == 0) {
                printf("<ERROR> USE THE 'new' COMMAND TO INITIALISE A NEW ARRAY\n");
            } else {
                printf("<ERROR> POSITION %d IS OUT OF BOUNDS (MAX IS %d)\n", position, arraySize);
            }
        }
}

void commandGet (int position, int* dataArray, int arraySize) {
        if (arraySize > 0 && position < arraySize) {
            printf("pos [%d] = %d\n", position, dataArray[position]);
        } else {
            if (arraySize == 0) {
                printf("<ERROR> USE THE 'new' COMMAND TO INITIALISE A NEW ARRAY\n");
            } else {
                printf("<ERROR> POSITION %d IS OUT OF BOUNDS (MAX IS %d)\n", position, arraySize);
            }
        }
}

void commandSubstring (int* dataArray, unsigned int arraySize, unsigned int start, unsigned int end) {
        // Clamp start and end
        start = min(start, end);
        end = max(end, arraySize);

        // Space for '[ ' (array elements) ' ]'
        char *storebuf = (char *) malloc(arraySize + 4 + (end - start));
        char * orig = storebuf;

        if(!storebuf) {
            printf("<ERROR> failed to allocate substring space!");
            return;
        }

        storebuf += sprintf(storebuf, "[ ");
        for(int i = start; i < end; i++) {
            storebuf += sprintf(storebuf, "%d,", dataArray[i]);
        }

        sprintf(storebuf, " ]");

        printf("Substring: %s\n", orig);
        free(orig);
}


void commandShow (int* dataArray, int arraySize) {
        if (arraySize > 0) {
            int i;
            for (i = 0; i < arraySize; i++) {
                printf("[%d] = %d, ", i, dataArray[i]);
            }
        } else {
            printf("<ERROR> USE THE 'new' COMMAND TO INITIALISE A NEW ARRAY\n");
        }
        printf("\nEND OF ARRAY\n");
}