sync with Tizen 4.0 mtp-responder

- Fix svace issue
- Fix DDos problem

Signed-off-by: Jihoon Jung <jh8801.jung@samsung.com>
Change-Id: Iee8fee79f24c0ef7d7e312a4618a8af070964dfa

diff --git a/packaging/mtp-responder.spec b/packaging/mtp-responder.spec
index 567671b..849f491 100755 (executable)
--- a/packaging/mtp-responder.spec
+++ b/packaging/mtp-responder.spec
@@ -5,7 +5,7 @@ ExcludeArch: %arm aarch64
 
 Name:       mtp-responder
 Summary:    Media Transfer Protocol daemon (responder)
-Version:    0.0.30
+Version:    0.0.31
 Release:    1
 Group:      Network & Connectivity/Other
 License:    Apache-2.0

diff --git a/src/mtp_cmd_handler.c b/src/mtp_cmd_handler.c
index cce170e..c2e1086 100755 (executable)
--- a/src/mtp_cmd_handler.c
+++ b/src/mtp_cmd_handler.c
@@ -42,6 +42,7 @@ extern pthread_mutex_t g_cmd_inoti_mutex;
 extern mtp_config_t g_conf;
 
 mtp_bool g_is_sync_estab = FALSE;
+mtp_bool g_is_send_object = FALSE;
 
 /*
  * STATIC VARIABLES
@@ -53,6 +54,8 @@ static mtp_uint16 g_count_open_session = 0;
 static mtp_uint32 g_old_open_session_time = 0;
 #endif/*MTP_USE_SKIP_CONTINUOUS_OPENSESSION*/
 
+#define LEN 20
+
 /*
  * STATIC FUNCTIONS
  */
@@ -289,6 +292,21 @@ static void __process_commands(mtp_handler_t *hdlr, cmd_blk_t *cmd)
                 */
                if (_device_get_phase() == DEVICE_PHASE_IDLE) {
                        DBG("DATAOUT COMMAND PHASE!!");
+                       if (hdlr->usb_cmd.code == PTP_OPCODE_SENDOBJECT) {
+                               mtp_char parent_path[MTP_MAX_PATHNAME_SIZE + 1] = { 0 };
+
+                               if (g_mgr->ftemp_st.filepath) {
+                                       _util_get_parent_path(g_mgr->ftemp_st.filepath, parent_path);
+                                       DBG("g_mgr->ftemp_st.filepath:[%s], parent_path[%s]\n", g_mgr->ftemp_st.filepath,  parent_path);
+
+                                       if ((g_strcmp0(parent_path, "/tmp")) != 0)
+                                               g_is_send_object = TRUE;
+                               }
+
+                               _eh_send_event_req_to_eh_thread(EVENT_START_DATAOUT,
+                                       0, 0, NULL);
+                       }
+
                        if (hdlr->usb_cmd.code == PTP_OPCODE_SENDOBJECT)
                                _eh_send_event_req_to_eh_thread(EVENT_START_DATAOUT,
                                                0, 0, NULL);
@@ -301,6 +319,8 @@ static void __process_commands(mtp_handler_t *hdlr, cmd_blk_t *cmd)
                        break;
                case PTP_OPCODE_SENDOBJECT:
                        __send_object(hdlr);
+                       g_is_send_object = FALSE;
+
                        _eh_send_event_req_to_eh_thread(EVENT_DONE_DATAOUT,
                                        0, 0, NULL);
                        break;
@@ -3266,25 +3286,57 @@ static mtp_bool __receive_temp_file_first_packet(mtp_char *data,
                mtp_int32 data_len)
 {
        mtp_char *filepath = g_mgr->ftemp_st.filepath;
+       temp_file_struct_t *t = &g_mgr->ftemp_st;
        mtp_int32 error = 0;
        mtp_uint32 *data_sz = &g_mgr->ftemp_st.data_size;
        mtp_char *buffer = g_mgr->ftemp_st.temp_buff;
+       mtp_char buff[LEN], *ptr;
+       mtp_char filename[MTP_MAX_FILENAME_SIZE] = {0};
+       mtp_uint32 i, num, start, range;
+       unsigned int seed;
 
        _transport_set_mtp_operation_state(MTP_STATE_DATA_TRANSFER_DL);
-       if (access(filepath, F_OK) == 0) {
+       if (!g_is_send_object) {
+               /*create a unique filename for /tmp/.mtptemp.tmp only if
+                is_send_object = 0. If is_send_object = 0 implies t->filepath
+                is set in send_object_proplist command to receive the
+                incoming file */
+               start = 'A';
+               range = 'Z' - 'A';
+
+               seed = time(NULL);
+               for (ptr = buff, i = 1; i < LEN; ++ptr, ++i) {
+                       num = rand_r(&seed) % range;
+                       *ptr = num+start;
+               }
+               *ptr = '\0';
+
+               g_snprintf(filename, MTP_MAX_FILENAME_SIZE, "%s%s%s", "/tmp/.mtptemp", buff, ".tmp");
+
+               if (t->filepath != NULL) {
+                       g_free(t->filepath);
+                       t->filepath = NULL;
+               }
+
+               t->filepath = g_strdup(filename);
+       }
+
+       DBG("t->filepath :%s\n", t->filepath);
+
+       if (access(t->filepath, F_OK) == 0) {
                if (g_mgr->ftemp_st.fhandle != NULL) {
                        _util_file_close(g_mgr->ftemp_st.fhandle);
                        g_mgr->ftemp_st.fhandle = NULL; /* initialize */
                }
 
-               if (remove(filepath) < 0) {
-                       ERR_SECURE("remove(%s) Fail", filepath);
+               if (remove(t->filepath) < 0) {
+                       ERR_SECURE("remove(%s) Fail", t->filepath);
                        __finish_receiving_file_packets(data, data_len);
                        return FALSE;
                }
        }
 
-       g_mgr->ftemp_st.fhandle = _util_file_open(filepath, MTP_FILE_WRITE, &error);
+       g_mgr->ftemp_st.fhandle = _util_file_open(t->filepath, MTP_FILE_WRITE, &error);
        if (g_mgr->ftemp_st.fhandle == NULL) {
                ERR("First file handle is invalid!!");
                __finish_receiving_file_packets(data, data_len);

diff --git a/src/mtp_cmd_handler_util.c b/src/mtp_cmd_handler_util.c
index 8bde5db..3be88cd 100755 (executable)
--- a/src/mtp_cmd_handler_util.c
+++ b/src/mtp_cmd_handler_util.c
@@ -338,7 +338,7 @@ mtp_err_t _hutil_add_object_entry(obj_info_t *obj_info, mtp_char *file_name,
                 */
 
                path_len = strlen(store->root_path) + strlen(MTP_TEMP_FILE) + 2;
-               g_mgr->ftemp_st.filepath = g_realloc(g_mgr->ftemp_st.filepath, path_len);
+               g_mgr->ftemp_st.filepath = (mtp_char*)g_malloc0(path_len);
                if (g_mgr->ftemp_st.filepath == NULL) {
                        ERR("g_realloc Fail");
                        _entity_dealloc_mtp_obj(obj);

diff --git a/src/mtp_init.c b/src/mtp_init.c
index 1fca0d2..a206959 100755 (executable)
--- a/src/mtp_init.c
+++ b/src/mtp_init.c
@@ -138,13 +138,6 @@ void _mtp_init(add_rem_store_t sel)
                _device_set_sync_partner(MTP_DEV_PROPERTY_SYNCPARTNER);
        }
 
-
-       g_mgr->ftemp_st.filepath = g_strdup(MTP_TEMP_FILE_DEFAULT);
-       if (g_mgr->ftemp_st.filepath == NULL) {
-               ERR("g_strdup() Fail");
-               goto MTP_INIT_FAIL;
-       }
-
        if (g_mgr->ftemp_st.temp_buff == NULL) {
                /* Allocate memory for temporary */
                g_mgr->ftemp_st.temp_buff = (mtp_char *)g_malloc(g_conf.write_file_size);

diff --git a/src/transport/mtp_transport.c b/src/transport/mtp_transport.c
index c178c51..3e78d89 100755 (executable)
--- a/src/transport/mtp_transport.c
+++ b/src/transport/mtp_transport.c
@@ -100,9 +100,14 @@ mtp_err_t _transport_rcv_temp_file_data(mtp_byte *buffer, mtp_uint32 size,
        }
 
        /* delete temp file, it have to be called in receive_data fn */
-       if (remove(g_mgr->ftemp_st.filepath) < 0) {
-               ERR_SECURE("remove(%s) Fail", g_mgr->ftemp_st.filepath);
-               _util_print_error();
+       if (g_mgr->ftemp_st.filepath != NULL) {
+               if (remove(g_mgr->ftemp_st.filepath) < 0) {
+                       ERR_SECURE("remove(%s) Fail", g_mgr->ftemp_st.filepath);
+                       _util_print_error();
+               }
+
+               g_free(g_mgr->ftemp_st.filepath);
+               g_mgr->ftemp_st.filepath = NULL;
        }
 
        g_mgr->ftemp_st.data_size = 0;
@@ -132,8 +137,11 @@ mtp_err_t _transport_rcv_temp_file_info(mtp_byte *buf, char *filepath,
        g_mgr->ftemp_st.data_size = 0;
        g_mgr->ftemp_st.data_count = 0;
 
-       g_strlcpy(g_mgr->ftemp_st.filepath, MTP_TEMP_FILE_DEFAULT,
-                       MTP_MAX_PATHNAME_SIZE + 1);
+       if (g_mgr->ftemp_st.filepath != NULL) {
+               g_free(g_mgr->ftemp_st.filepath);
+               g_mgr->ftemp_st.filepath = NULL;
+       }
+
        g_mgr->ftemp_st.fhandle = NULL;
        g_mgr->ftemp_st.file_size = 0;