Fix realpath issue

realpath may cause buffer overflow by design.
This patch fixes to pass NULL for resolved path to make realpath safe.

Change-Id: I881726619ec14d8cbc4f7c47cf7e8d57d5a13af2
Signed-off-by: Semun Lee <semun.lee@samsung.com>

diff --git a/src/pkg_cmd.c b/src/pkg_cmd.c
index 14e80bec49edd5ed74522d93958fb69646c60efe..27f87cec0eab952505d7a49133174f3b6a6511ae 100644 (file)
--- a/src/pkg_cmd.c
+++ b/src/pkg_cmd.c
@@ -137,9 +137,9 @@ struct pm_tool_args_t {
        char pkg_old[PATH_MAX];
        char pkg_new[PATH_MAX];
        char delta_pkg[PATH_MAX];
-       char resolved_path_pkg_old[PATH_MAX];
-       char resolved_path_pkg_new[PATH_MAX];
-       char resolved_path_delta_pkg[PATH_MAX];
+       char *resolved_path_pkg_old;
+       char *resolved_path_pkg_new;
+       char *resolved_path_delta_pkg;
        char label[PKG_NAME_STRING_LEN_MAX];
        char tep_path[PATH_MAX];
 
@@ -155,6 +155,16 @@ pm_tool_args data;
 
 static GMainLoop *main_loop = NULL;
 
+static void __free_data()
+{
+       if (data.resolved_path_pkg_old)
+               free(data.resolved_path_pkg_old);
+       if (data.resolved_path_pkg_new)
+               free(data.resolved_path_pkg_new);
+       if (data.resolved_path_delta_pkg)
+               free(data.resolved_path_delta_pkg);
+}
+
 static void __error_no_to_string(int errnumber, char **errstr)
 {
        if (errstr == NULL)
@@ -467,6 +477,7 @@ static void __print_usage()
        printf("pkgcmd -D -t app -n org.example.helloapp --global\n");
 
        printf("\n");
+       __free_data();
        exit(0);
 }
 
@@ -1267,9 +1278,6 @@ int main(int argc, char *argv[])
        memset(data.pkg_old, '\0', PATH_MAX);
        memset(data.pkg_new, '\0', PATH_MAX);
        memset(data.delta_pkg, '\0', PATH_MAX);
-       memset(data.resolved_path_pkg_old, '\0', PATH_MAX);
-       memset(data.resolved_path_pkg_new, '\0', PATH_MAX);
-       memset(data.resolved_path_delta_pkg, '\0', PATH_MAX);
        memset(data.pkg_type, '\0', PKG_TYPE_STRING_LEN_MAX);
        memset(data.label, '\0', PKG_TYPE_STRING_LEN_MAX);
        memset(data.tep_path, '\0', PATH_MAX);
@@ -1367,6 +1375,7 @@ int main(int argc, char *argv[])
                        ret = __convert_to_absolute_path(data.pkg_path);
                        if (ret == -1) {
                                printf("conversion of relative path to absolute path failed\n");
+                               __free_data();
                                return -1;
                        }
                        printf("path is %s\n", data.pkg_path);
@@ -1378,8 +1387,10 @@ int main(int argc, char *argv[])
                        if (optarg)
                                strncpy(data.pkg_old, optarg, PATH_MAX - 1);
 
-                       if (realpath(data.pkg_old, data.resolved_path_pkg_old) == NULL) {
+                       data.resolved_path_pkg_old = realpath(data.pkg_old, NULL);
+                       if (data.resolved_path_pkg_old == NULL) {
                                printf("failed to set realpath\n");
+                               __free_data();
                                return -1;
                        }
                        printf("pkg_old abs path is %s\n", data.resolved_path_pkg_old);
@@ -1389,8 +1400,10 @@ int main(int argc, char *argv[])
                        if (optarg)
                                strncpy(data.pkg_new, optarg, PATH_MAX - 1);
 
-                       if (realpath(data.pkg_new, data.resolved_path_pkg_new) == NULL) {
+                       data.resolved_path_pkg_new = realpath(data.pkg_new, NULL);
+                       if (data.resolved_path_pkg_new == NULL) {
                                printf("failed to set realpath\n");
+                               __free_data();
                                return -1;
                        }
                        printf("pkg_new abs path is %s\n", data.resolved_path_pkg_new);
@@ -1401,8 +1414,11 @@ int main(int argc, char *argv[])
                                strncpy(data.delta_pkg, optarg, PATH_MAX - 1);
 
                        printf("delta_pkg is %s\n", data.delta_pkg);
-                       if (realpath(data.delta_pkg, data.resolved_path_delta_pkg) == NULL) {
+
+                       data.resolved_path_delta_pkg = realpath(data.delta_pkg, NULL);
+                       if (data.resolved_path_delta_pkg == NULL) {
                                printf("failed to set realpath\n");
+                               __free_data();
                                return -1;
                        }
                        printf("delta_pkg abs path is %s\n", data.resolved_path_delta_pkg);
@@ -1426,6 +1442,7 @@ int main(int argc, char *argv[])
                        ret = __convert_to_absolute_tep_path(data.tep_path);
                        if (ret == -1) {
                                printf("conversion of relative tep path to absolute path failed\n");
+                               __free_data();
                                return -1;
                        }
                        printf("TEP path is %s\n", data.tep_path);
@@ -1478,6 +1495,7 @@ int main(int argc, char *argv[])
        uid_t uid = getuid();
        if (is_root_cmd && uid != OWNER_ROOT) {
                printf("This cmd is allowed for only root user\n");
+               __free_data();
                return -1;
        }
 
@@ -1501,6 +1519,7 @@ int main(int argc, char *argv[])
        gettimeofday(&tv, NULL);
        endtime = tv.tv_sec * 1000l + tv.tv_usec / 1000l;
        printf("spend time for pkgcmd is [%d]ms\n", (int)(endtime - starttime));
+       __free_data();
 
        return data.result;
 }