fix security issue(TSAM-13252)

Change-Id: I99c089e88868edbad0532510be7e838e4d570f5f
Signed-off-by: HyiHong Chae <hh.chae@samsung.com>

diff --git a/include/util/mtp_support.h b/include/util/mtp_support.h
index b0cc9c41418d0b4c3c1d5183c87a924090d6c301..a67325bdbb9b388ea0e30294646b395f703f6953 100755 (executable)
--- a/include/util/mtp_support.h
+++ b/include/util/mtp_support.h
@@ -54,5 +54,6 @@ void _util_get_parent_path(const mtp_char *fullpath, mtp_char *p_path);
 void _util_conv_wstr_to_guid(mtp_wchar *wstr, mtp_uint64 *guid);
 mtp_bool _util_get_unique_dir_path(const mtp_char *exist_path, mtp_char *new_path,
                mtp_uint32 new_path_buf_len);
+mtp_int32 _util_system_cmd_wait(const mtp_char *cmd);
 
 #endif /* _MTP_SUPPORT_H_ */

diff --git a/packaging/mtp-responder.spec b/packaging/mtp-responder.spec
index d333fb0b0615bd1ad47231deffd26e081f84c65e..8317525a2b313c7208ac1c6e3074fe2d80c88fad 100755 (executable)
--- a/packaging/mtp-responder.spec
+++ b/packaging/mtp-responder.spec
@@ -5,7 +5,7 @@ ExcludeArch: %arm aarch64
 
 Name:       mtp-responder
 Summary:    Media Transfer Protocol daemon (responder)
-Version:    0.0.23
+Version:    0.0.24
 Release:    1
 Group:      Network & Connectivity/Other
 License:    Apache-2.0

diff --git a/src/entity/mtp_store.c b/src/entity/mtp_store.c
index 7297d8ba95364710b347848eeb38f33ed77810b3..c3ae8ac382dffe0fe7c0ed1c1fb4a03c50d0bcba 100755 (executable)
--- a/src/entity/mtp_store.c
+++ b/src/entity/mtp_store.c
@@ -1199,7 +1199,8 @@ void _entity_list_modified_files(mtp_uint32 minutes)
                                inter_path, minutes,
                                MTP_FILES_MODIFIED_FILES);
                DBG("find query is [%s]\n", command);
-               ret = system(command);
+               ret = _util_system_cmd_wait(command);
+
                if (WIFSIGNALED(ret) &&
                                (WTERMSIG(ret) == SIGINT ||
                                 WTERMSIG(ret) == SIGQUIT)) {
@@ -1215,7 +1216,8 @@ void _entity_list_modified_files(mtp_uint32 minutes)
                                ext_path, minutes,
                                MTP_FILES_MODIFIED_FILES);
                DBG("find query is [%s]\n", command);
-               ret = system(command);
+               ret = _util_system_cmd_wait(command);
+
                if (WIFSIGNALED(ret) &&
                                (WTERMSIG(ret) == SIGINT ||
                                 WTERMSIG(ret) == SIGQUIT)) {

diff --git a/src/transport/mtp_transport.c b/src/transport/mtp_transport.c
index 3eee08b0a48f053721e9fe0f2b445d650c02ae33..7c73bbdd951c33f995dbc9a765b0ffb9aeacb2c3 100755 (executable)
--- a/src/transport/mtp_transport.c
+++ b/src/transport/mtp_transport.c
@@ -419,6 +419,7 @@ void _transport_usb_finalize(void)
                                        sizeof(msgq_ptr_t) - sizeof(long), 0)) {
                        ERR("_util_msgq_send() Fail");
                }
+               g_free(pkt.buffer);
 
                res = _util_thread_join(g_data_rcv, &th_result);
                if (res == FALSE)

diff --git a/src/util/mtp_support.c b/src/util/mtp_support.c
index 83108d6325d383b122fac0cd209a234ed6aaadbc..8517146219ab14cc9f7735983895b3b3b0e2f9d8 100755 (executable)
--- a/src/util/mtp_support.c
+++ b/src/util/mtp_support.c
@@ -17,6 +17,7 @@
 #include <glib.h>
 #include <glib/gprintf.h>
 #include <unistd.h>
+#include <sys/wait.h>
 #include "mtp_support.h"
 #include "ptp_datacodes.h"
 #include "mtp_util.h"
@@ -643,3 +644,38 @@ SUCCESS:
        DBG_SECURE("Unique dir name[%s]\n", new_path);
        return TRUE;
 }
+
+mtp_int32 _util_system_cmd_wait(const mtp_char *cmd)
+{
+
+       int pid = 0;
+       int status = 0;
+
+       if (cmd == NULL)
+               return -1;
+
+       pid = fork();
+
+       if (pid == -1)
+               return -1;
+
+       if (pid == 0) {
+               char *argv[4];
+               argv[0] = "sh";
+               argv[1] = "-c";
+               argv[2] = (char*)cmd;
+               argv[3] = 0;
+               execv("/bin/sh", argv);
+               exit(127);
+       }
+
+       do {
+               if (waitpid(pid, &status, 0) == -1) {
+                       if (errno != EINTR)
+                               return -1;
+               } else {
+                       return status;
+               }
+       } while (1);
+}
+