Fix security issues

- Prevent making not intended file
- Use %q instead of %s for preventing SQL injection

Change-Id: I778a2d3ff8af26112bca346b62b19322e094a01d
Signed-off-by: Kichan Kwon <k_c.kwon@samsung.com>

diff --git a/src/heart/heart-appopt.c b/src/heart/heart-appopt.c
index d783fe9..9f2fbea 100644 (file)
--- a/src/heart/heart-appopt.c
+++ b/src/heart/heart-appopt.c
@@ -49,11 +49,11 @@
 #define APP_OPTS_TABLE         "appopts"
 #define QUERY_CREATE_APPNAMES  "CREATE TABLE IF NOT EXISTS "APP_NAMES_TABLE" (appkey INTEGER PRIMARY KEY AUTOINCREMENT, appname TEXT NOT NULL UNIQUE);"
 #define QUERY_CREATE_APPOPTS   "CREATE TABLE IF NOT EXISTS "APP_OPTS_TABLE" (appkey INTEGER PRIMARY KEY, last_used INT NOT NULL, cur_opt INT NOT NULL, to_be_opt INT NOT NULL, FOREIGN KEY(appkey) REFERENCES "APP_NAMES_TABLE"(appkey));"
-#define QUERY_INSERT_APPNAME   "INSERT OR IGNORE INTO "APP_NAMES_TABLE"(appname) VALUES ('%s');"
+#define QUERY_INSERT_APPNAME   "INSERT OR IGNORE INTO "APP_NAMES_TABLE"(appname) VALUES ('%q');"
 #define QUERY_INSERT_APPOPTS   "REPLACE INTO "APP_OPTS_TABLE" VALUES ('%d','%d','%d','%d');"
 #define QUERY_DELETE_ENTRY     "DELETE FROM %s WHERE appkey = %d;"
 #define QUERY_SELECT_APPOPTS   "SELECT appname,last_used,cur_opt,to_be_opt FROM "APP_NAMES_TABLE","APP_OPTS_TABLE" WHERE "APP_NAMES_TABLE".appkey = "APP_OPTS_TABLE".appkey;"
-#define QUERY_SELECT_APPNAME   "SELECT * FROM "APP_NAMES_TABLE " WHERE appname = '%s';"
+#define QUERY_SELECT_APPNAME   "SELECT * FROM "APP_NAMES_TABLE " WHERE appname = '%q';"
 #define APPOPT_DATA_MAX                1024
 #define SQLITE_BUSY_TIMEOUT    50000
 
@@ -150,7 +150,7 @@ static int heart_appopt_db_get_appkey(sqlite3 *db, char *appname, int *appkey)
        char buf[APPOPT_DATA_MAX] = {0, };
        int ret;
 
-       snprintf(buf, APPOPT_DATA_MAX, QUERY_SELECT_APPNAME, appname);
+       sqlite3_snprintf(APPOPT_DATA_MAX, buf, QUERY_SELECT_APPNAME, appname);
 
        ret = sqlite3_prepare_v2(db, buf, -1, &stmt, NULL);
        if (ret != SQLITE_OK) {
@@ -218,7 +218,7 @@ static int heart_appopt_db_insert_entry(sqlite3 *db, struct appopt_data *data)
 
        /* Make sure appname is present in the appnames dictionary */
 
-       snprintf(buf, APPOPT_DATA_MAX, QUERY_INSERT_APPNAME, data->appname);
+       sqlite3_snprintf(APPOPT_DATA_MAX, buf, QUERY_INSERT_APPNAME, data->appname);
 
        if (sqlite3_exec(db, buf, NULL, NULL, &sqlite3_error_msg) != SQLITE_OK) {
                _E("sqlite3_exec(\"%s\") failed! -> %s", buf, sqlite3_error_msg);

diff --git a/src/proc-stat/proc-main.c b/src/proc-stat/proc-main.c
index a8e13a9..439d738 100644 (file)
--- a/src/proc-stat/proc-main.c
+++ b/src/proc-stat/proc-main.c
@@ -1125,6 +1125,8 @@ int proc_get_state(int type, pid_t pid, char *buf, int len)
 void resourced_proc_dump(int mode, const char *dirpath)
 {
        char buf[MAX_PATH_LENGTH];
+       char filename[MAX_NAME_LENGTH];
+       int name_len;
        _cleanup_fclose_ FILE *f = NULL;
 
        if (dirpath) {
@@ -1135,10 +1137,17 @@ void resourced_proc_dump(int mode, const char *dirpath)
                if (localtime_r(&now, &cur_tm) == NULL)
                        _E("Fail to get localtime");
 
-               snprintf(buf, sizeof(buf), "%s/%s_%.4d%.2d%.2d%.2d%.2d%.2d.log",
-                   dirpath, LOG_PREFIX, (1900 + cur_tm.tm_year), 1 + cur_tm.tm_mon,
-                   cur_tm.tm_mday, cur_tm.tm_hour, cur_tm.tm_min,
-                   cur_tm.tm_sec);
+               name_len = snprintf(filename, MAX_NAME_LENGTH,
+                               "/%s_%.4d%.2d%.2d%.2d%.2d%.2d.log",
+                               LOG_PREFIX, (1900 + cur_tm.tm_year), 1 + cur_tm.tm_mon,
+                               cur_tm.tm_mday, cur_tm.tm_hour, cur_tm.tm_min, cur_tm.tm_sec);
+
+               if (strlen(dirpath) + name_len + 1 > MAX_PATH_LENGTH) {
+                       _E("Dump path %s is too long");
+                       return;
+               }
+
+               snprintf(buf, MAX_PATH_LENGTH, "%s%s", dirpath, filename);
                f = fopen(buf, "w+");
        }
        proc_dump_process_list(f);