Fix vulnerabilities

Change-Id: Ie00209cf38eaf20507e981812101a6206c29de6c
Signed-off-by: Sunmin Lee <sunm.lee@samsung.com>

diff --git a/src/plugin/http_util.c b/src/plugin/http_util.c
index 16f381175677e30b7463b0921fce36f3827fd538..62ea84ec25d598dfdfe052a4a436c744e2d1beff 100644 (file)
--- a/src/plugin/http_util.c
+++ b/src/plugin/http_util.c
@@ -155,6 +155,7 @@ static void *_print_download_progress(void *download_path)
 {
        FILE *fp = NULL;
        int retry = 0;
+       char buf[256];
 
        do {
                sleep(1);
@@ -165,7 +166,8 @@ static void *_print_download_progress(void *download_path)
                                retry++;
                                if (retry >= 3) {
                                        _E("Failed to open %s", (char *)download_path);
-                                       _E("%s", strerror(errno));
+                                       strerror_r(errno, buf, sizeof(buf));
+                                       _E("%s", buf);
                                        break;
                                }
                                continue;
@@ -178,6 +180,7 @@ static void *_print_download_progress(void *download_path)
 
                if (binary_size <= 0) {
                        _E("Package size is not set. Can not print progress");
+                       fclose(fp);
                        return 0;
                }
 
@@ -188,10 +191,10 @@ static void *_print_download_progress(void *download_path)
                        snprintf(bar, sizeof(bar), "[");
                        int i = 1;
                        for (; i <= GAUGE_LENGTH * progress; i++)
-                               snprintf(bar + strlen(bar), sizeof(bar), "=");
+                               snprintf(bar + strlen(bar), sizeof(bar) - 1, "=");
                        for (; i <= GAUGE_LENGTH; i++)
-                               snprintf(bar + strlen(bar), sizeof(bar), ".");
-                       snprintf(bar + strlen(bar), sizeof(bar), "]");
+                               snprintf(bar + strlen(bar), sizeof(bar) - 1, ".");
+                       snprintf(bar + strlen(bar), sizeof(bar) - 1, "]");
 
                        _D("%s | %d / %d (%d %%)",
                                        bar, size, binary_size,
@@ -204,7 +207,8 @@ static void *_print_download_progress(void *download_path)
                }
        } while (1);
 
-       fclose(fp);
+       if (fp)
+               fclose(fp);
 
        return 0;
 }
@@ -234,6 +238,7 @@ int http_util_check_request_to_fota(const char *uid,
 
        tmp_header = g_strconcat("X-IOT-UID: ", uid, NULL);
        header = curl_slist_append(header, tmp_header);
+       g_free(tmp_header);
        tmp_header = g_strconcat("Authorization: ", "Bearer ", access_token, NULL);
        header = curl_slist_append(header, tmp_header);
        g_free(tmp_header);
@@ -269,6 +274,8 @@ END:
                g_byte_array_free(response_header, TRUE);
        if (response_body)
                g_byte_array_free(response_body, TRUE);
+       if (req_url)
+               g_free(req_url);
 
        curl_easy_cleanup(curl);
        return ret;
@@ -319,7 +326,8 @@ int http_util_download_file(const char *download_url, const char *download_path,
 
        if (err != CURLE_OK) {
                _I("Failed to download file[%s, %d]", curl_easy_strerror(err), err);
-               remove(download_path);
+               if (remove(download_path) < 0)
+                       _E("Failed to remove [%s]", download_path);
                return -EIO;
        }
 

diff --git a/src/plugin/plugin.c b/src/plugin/plugin.c
index 43d6e0f3d16a45804f61749fb23d0f089d0d184b..7f5d2df3699bbdd7a2ffec2154650d3aa5a94dd5 100644 (file)
--- a/src/plugin/plugin.c
+++ b/src/plugin/plugin.c
@@ -203,7 +203,7 @@ static int set_polling_alarm(void)
 {
        int ret, week_flag;
        time_t cur_time;
-       struct tm *polling_time;
+       struct tm polling_time;
        alarm_date_t alarm_time;
        alarm_entry_t *alarm_info = NULL;
 
@@ -214,24 +214,24 @@ static int set_polling_alarm(void)
        }
 
        cur_time = time(NULL);
-       polling_time = localtime(&cur_time);
+       localtime_r(&cur_time, &polling_time);
 
        /* Polling period: every AM 3:00 */
-       polling_time->tm_hour = 3;
-       polling_time->tm_min = 0;
-       polling_time->tm_sec = 0;
+       polling_time.tm_hour = 3;
+       polling_time.tm_min = 0;
+       polling_time.tm_sec = 0;
 
        week_flag = ALARM_WDAY_SUNDAY | ALARM_WDAY_MONDAY |
                ALARM_WDAY_TUESDAY | ALARM_WDAY_WEDNESDAY |
                ALARM_WDAY_THURSDAY | ALARM_WDAY_FRIDAY |
                ALARM_WDAY_SATURDAY;
 
-       alarm_time.year = polling_time->tm_year + 1900;
-       alarm_time.month = polling_time->tm_mon + 1;
-       alarm_time.day = polling_time->tm_mday;
-       alarm_time.hour = polling_time->tm_hour;
-       alarm_time.min = polling_time->tm_min;
-       alarm_time.sec = polling_time->tm_sec;
+       alarm_time.year = polling_time.tm_year + 1900;
+       alarm_time.month = polling_time.tm_mon + 1;
+       alarm_time.day = polling_time.tm_mday;
+       alarm_time.hour = polling_time.tm_hour;
+       alarm_time.min = polling_time.tm_min;
+       alarm_time.sec = polling_time.tm_sec;
 
        ret = alarmmgr_set_time(alarm_info, alarm_time);
        if (ret != ALARMMGR_RESULT_SUCCESS) {
@@ -240,7 +240,7 @@ static int set_polling_alarm(void)
                goto out;
        }
        _D("Polling alarm is set at every %d:%d",
-                       polling_time->tm_hour, polling_time->tm_min);
+                       polling_time.tm_hour, polling_time.tm_min);
 
        ret = alarmmgr_set_repeat_mode(alarm_info, ALARM_REPEAT_MODE_WEEKLY, week_flag);
        if (ret != ALARMMGR_RESULT_SUCCESS) {
@@ -268,18 +268,23 @@ static int parse_and_set_firmware_info(char *json)
 {
        char *token;
        char *key, *value;
+       char *saveptr = NULL;
 
        retvm_if(!json || *json != '{', false, "Invalid json format");
 
-       token = strtok(json, "\"");
-       while ((token = strtok(NULL, ",\"")) != NULL) {
+       token = strtok_r(json, "\"", &saveptr);
+       while ((token = strtok_r(NULL, ",\"", &saveptr)) != NULL) {
                if (*token == '}')
                        break;
                key = strdup(token);
-               token = strtok(NULL, ",\"");
-               retvm_if(*token != ':', false, "Invalid json format");
+               token = strtok_r(NULL, ",\"", &saveptr);
+               if (*token != ':') {
+                       _E("Invalid json format");
+                       free(key);
+                       return -1;
+               }
                if (strlen(token) == 1) {
-                       token = strtok(NULL, "\"");
+                       token = strtok_r(NULL, "\"", &saveptr);
                        if (*token == ',' || *token == '}')
                                *token = 0;
                } else {
@@ -334,16 +339,17 @@ static bool check_new_version(const char *current, const char* new)
 static int parse_secure_url(char *json, char **url_value)
 {
        char *ret;
+       char *saveptr = NULL;
 
-       retvm_if(!json && *json != '{' && *(json + 1) != '\"', false, "Invalid json format");
+       retvm_if(!json || *json != '{' || *(json + 1) != '\"', false, "Invalid json format");
 
-       ret = strtok(json, "{\"");
+       ret = strtok_r(json, "{\"", &saveptr);
        retvm_if(!ret && !STR_EQ(ret, "url"), -1, "Invalid json(url)");
 
-       ret = strtok(NULL, "\"");
+       ret = strtok_r(NULL, "\"", &saveptr);
        retvm_if(!ret && !STR_EQ(ret, ":"), -1, "Invalid json(:)");
 
-       ret = strtok(NULL, "\"");
+       ret = strtok_r(NULL, "\"", &saveptr);
        retvm_if(!ret, -1, "Invalid json(end)");
 
        *url_value = g_strdup(ret);
@@ -366,7 +372,10 @@ static char *get_download_url(const char *uri)
        /* Parsing URL */
        /* {"url":"https://iotm-dev-fota.s3-a...} */
        ret = parse_secure_url(body, &download_url);
-       retvm_if(ret < 0, NULL, "Failed to parse download url from body[%d]", ret);
+       if (ret < 0) {
+               _E("Failed to parse download url from body[%d]", ret);
+               G_FREE(download_url);
+       }
 
        G_FREE(header);
        G_FREE(body);
@@ -478,6 +487,11 @@ API int update_control_initialize(void)
 #endif
 
        update_info = (struct _update_info *)malloc(sizeof(*update_info));
+       if (!update_info) {
+               _E("Failed to malloc");
+               return UPDATE_CONTROL_ERROR_OUT_OF_MEMORY;
+       }
+
        update_info->new_version = NULL;
        update_info->package_uri = NULL;
        update_info->package_size = 0;
@@ -545,7 +559,7 @@ API int update_control_check_new_version(void)
        }
 #endif
 
-       int ret;
+       int ret = UPDATE_CONTROL_ERROR_NONE;
        char *device_type = NULL;
        char *version = NULL;
        char *res_header = NULL;
@@ -559,13 +573,15 @@ API int update_control_check_new_version(void)
                        &device_type);
        if (ret != SYSTEM_INFO_ERROR_NONE) {
                _E("Failed to get model_name [%d]", ret);
-               return UPDATE_CONTROL_ERROR_SYSTEM_ERROR;
+               ret = UPDATE_CONTROL_ERROR_SYSTEM_ERROR;
+               goto exit;
        }
        ret = system_info_get_platform_string("http://tizen.org/system/build.release",
                        &version);
        if (ret != SYSTEM_INFO_ERROR_NONE) {
                _E("Failed to get build.release [%d]", ret);
-               return UPDATE_CONTROL_ERROR_SYSTEM_ERROR;
+               ret = UPDATE_CONTROL_ERROR_SYSTEM_ERROR;
+               goto exit;
        }
        _D("Device info: Device Type [%s], Version [%s]", device_type, version);
 
@@ -574,7 +590,8 @@ API int update_control_check_new_version(void)
                _D("The cloud account info is not set so request it. Try again later");
                request_cloud_accout();
                /* Wait for response from smartthings-thing */
-               return UPDATE_CONTROL_ERROR_CONNECTION_REFUSED;
+               ret = UPDATE_CONTROL_ERROR_CONNECTION_REFUSED;
+               goto exit;
        } else {
                _D("The cloud account is not empty: token = [%s], id = [%s]",
                                cloud_account.access_token, cloud_account.user_id);
@@ -585,7 +602,8 @@ API int update_control_check_new_version(void)
                        &res_header, &res_body);
        if (!res_body || STR_EMPTY(res_body)) {
                _E("No response for check request.");
-               return UPDATE_CONTROL_ERROR_CONNECTION_REFUSED;
+               ret = UPDATE_CONTROL_ERROR_CONNECTION_REFUSED;
+               goto exit;
        }
        parse_and_set_firmware_info(res_body);
 
@@ -596,7 +614,17 @@ API int update_control_check_new_version(void)
                _D("Already latest version: %s", version);
        }
 
-       return UPDATE_CONTROL_ERROR_NONE;
+exit:
+       if (device_type)
+               free(device_type);
+       if (version)
+               free(version);
+       if (res_header)
+               free(res_header);
+       if (res_body)
+               free(res_body);
+
+       return ret;
 }
 
 API int update_control_download_package(void)
@@ -610,6 +638,7 @@ API int update_control_download_package(void)
 #endif
 
        int ret = 0;
+       char *app_path = NULL;
        char *download_url = NULL;
        char *download_path = NULL;
 
@@ -622,27 +651,41 @@ API int update_control_download_package(void)
        /* Downloading state */
        _D("Download package from [%s]", update_info->package_uri);
 
+       app_path = app_get_data_path();
+       retvm_if(!app_path, UPDATE_CONTROL_ERROR_SYSTEM_ERROR,
+                       "Failed to app_get_data_path");
        download_url = get_download_url(update_info->package_uri);
        download_path = g_strconcat(app_get_data_path(), FIRMWARE_FILE_NAME, NULL);
 
-       retvm_if(!download_url, UPDATE_CONTROL_ERROR_SYSTEM_ERROR,
-                       "Failed to get download url");
-       retvm_if(!download_path, UPDATE_CONTROL_ERROR_SYSTEM_ERROR,
-                       "Failed to compose download path");
+       if (!download_url) {
+               _E("Failed to get download url");
+               ret = UPDATE_CONTROL_ERROR_SYSTEM_ERROR;
+               goto exit;
+       }
+       if (!download_path) {
+               _E("Failed to compose download path");
+               ret = UPDATE_CONTROL_ERROR_SYSTEM_ERROR;
+               goto exit;
+       }
 
        _I("Download url[%s] download path[%s]", download_url, download_path);
 
        ret = http_util_download_file((const char *)download_url, (const char *)download_path,
                        update_info->package_size);
-       retvm_if(ret < 0, UPDATE_CONTROL_ERROR_CONNECTION_REFUSED,
-                       "Failed to download firmware[%d]", ret);
+       if (ret < 0) {
+               _E("Failed to download firmware[%d]", ret);
+               ret = UPDATE_CONTROL_ERROR_CONNECTION_REFUSED;
+               goto exit;
+       }
 
+       package_downloaded = true;
+
+exit:
+       G_FREE(app_path);
        G_FREE(download_url);
        G_FREE(download_path);
 
-       package_downloaded = true;
-
-       return UPDATE_CONTROL_ERROR_NONE;
+       return ret;
 }
 
 API int update_control_do_update(void)
@@ -656,6 +699,7 @@ API int update_control_do_update(void)
        }
 #endif
 
+       char *app_path = NULL;
        char *path = NULL;
 
        if (!package_downloaded) {
@@ -667,9 +711,15 @@ API int update_control_do_update(void)
 
        _D("Firmware Updating...");
 
-       path = g_strconcat(app_get_data_path(), FIRMWARE_FILE_NAME, NULL);
-       retvm_if(!path, UPDATE_CONTROL_ERROR_SYSTEM_ERROR,
-                       "Invalid parameter");
+       app_path = app_get_data_path();
+       retvm_if(!app_path, UPDATE_CONTROL_ERROR_SYSTEM_ERROR,
+                       "Failed to app_get_data_path");
+       path = g_strconcat(app_path, FIRMWARE_FILE_NAME, NULL);
+       if (!path) {
+               _E("Failed to g_strconcat");
+               G_FREE(app_path);
+               return UPDATE_CONTROL_ERROR_SYSTEM_ERROR;
+       }
 
        /* DBus activation */
        send_update_signal(path);
@@ -680,6 +730,9 @@ API int update_control_do_update(void)
        /* Should be unreachable */
        _E("Update reboot timed out");
 
+       G_FREE(app_path);
+       G_FREE(path);
+
        return UPDATE_CONTROL_ERROR_TIMED_OUT;
 }
 
@@ -814,6 +867,11 @@ API int update_control_get_property(update_control_property_e property, void **v
        case UPDATE_CONTROL_PROPERTY_PACKAGE_SIZE:
                if (update_info->package_size) {
                        *value = malloc(sizeof(int));
+                       if (!*value) {
+                               _E("Failed to malloc");
+                               return UPDATE_CONTROL_ERROR_OUT_OF_MEMORY;
+                       }
+
                        *(int *)(*value) = update_info->package_size;
                } else {
                        _D("Package size is not set");
@@ -821,6 +879,11 @@ API int update_control_get_property(update_control_property_e property, void **v
                break;
        case UPDATE_CONTROL_PROPERTY_RESULT:
                *value = malloc(sizeof(int));
+               if (!*value) {
+                       _E("Failed to malloc");
+                       return UPDATE_CONTROL_ERROR_OUT_OF_MEMORY;
+               }
+
                if (send_get_result_signal((int *)*value) < 0) {
                        free(*value);
                        *value = NULL;
@@ -834,6 +897,11 @@ API int update_control_get_property(update_control_property_e property, void **v
                break;
        case UPDATE_CONTROL_PROPERTY_UPDATE_AVAILABLE:
                *value = malloc(sizeof(int));
+               if (!*value) {
+                       _E("Failed to malloc");
+                       return UPDATE_CONTROL_ERROR_OUT_OF_MEMORY;
+               }
+
                *(int *)(*value) = update_info->updatable;
                break;
        default: