tbm_surface_queue: pending delete queue_node until released queue

[platform/core/uifw/libtbm.git] / src / tbm_drm_helper_client.c

diff --git a/src/tbm_drm_helper_client.c b/src/tbm_drm_helper_client.c
index 0ca1575..7980e1e 100644 (file)
--- a/src/tbm_drm_helper_client.c
+++ b/src/tbm_drm_helper_client.c
@@ -221,16 +221,39 @@ int
 tbm_drm_helper_get_fd(void)
 {
        const char *value;
-       int ret, flags, fd = -1;
+       int flags, fd = -1;
        int new_fd = -1;
+       char *end;
+       errno = 0;
 
        value = (const char*)getenv("TBM_DRM_FD");
        if (!value)
                return -1;
 
-       ret = sscanf(value, "%d", &fd);
-       if (ret <= 0)
+       const long sl = strtol(value, &end, 10);
+       if (end == value) {
+               TBM_LOG_E("%s: not a decimal number\n", value);
                return -1;
+       } else if (*end != '\0') {
+               TBM_LOG_E("%s: extra characters at end of input: %s\n", value, end);
+               return -1;
+       } else if ((sl == LONG_MIN || sl == LONG_MAX) && errno == ERANGE) {
+               TBM_LOG_E("%s out of range of type long\n", value);
+               return -1;
+       } else if (sl > INT_MAX) {
+               TBM_LOG_E("%ld greater than INT_MAX\n", sl);
+               return -1;
+       } else if (sl < INT_MIN) {
+               TBM_LOG_E("%ld less than INT_MIN\n", sl);
+               return -1;
+       } else {
+               int fd_max = tbm_bufmgr_get_fd_limit();
+               fd = (int)sl;
+               if (fd < 0 || fd > fd_max) {
+                       TBM_LOG_E("%d out of fd range\n", fd);
+                       return -1;
+               }
+       }
 
        TBM_LOG_I("TBM_DRM_FD: %d\n", fd);
 
@@ -246,7 +269,11 @@ tbm_drm_helper_get_fd(void)
                return -1;
        }
 
-       fcntl(new_fd, F_SETFD, flags|FD_CLOEXEC);
+       if (fcntl(new_fd, F_SETFD, flags|FD_CLOEXEC) == -1) {
+               TBM_LOG_E("failed to set fd\n");
+               close(new_fd);
+               return -1;
+       }
 
        TBM_LOG_I("Return TBM_FD: %d\n", new_fd);