fix TOCTOU Issue by fixing access to path check

Calling function 'fopen' after check function like 'access' which perform
check on path can cause a time-of-check, time-of-use race condition.
For resolving this, remove 'access' and
just print error message of fopen() fail with errno.

Change-Id: I46b4639815b52fef1548209d703cf40d9ee6920b

diff --git a/base/base_gui_direct.h b/base/base_gui_direct.h
index 692717a73d157eaa341e82223a26332d8161509c..2e56a71a133ebd01c1e8bdcd03f60c7745690e72 100644 (file)
--- a/base/base_gui_direct.h
+++ b/base/base_gui_direct.h
@@ -20,6 +20,7 @@
 #define __BASE_GUI_DIRECT_H__
 
 #include "gui_general.h"
+#include <errno.h>
 
 extern int fota_gr_direct_init(void);
 extern void fota_gr_direct_deinit(void);

diff --git a/fota_gui_common/fota_gr_direct_ro_common.c b/fota_gui_common/fota_gr_direct_ro_common.c
index 9a83fb8057560cac4f3d21d688c42eb5db7a8df3..9ef0a06fe9f2586faceb55c2bf62b126f60084c3 100644 (file)
--- a/fota_gui_common/fota_gr_direct_ro_common.c
+++ b/fota_gui_common/fota_gr_direct_ro_common.c
@@ -35,23 +35,23 @@ int fota_gr_direct_update_progress(int * s_saved_percent, int * s_percent_to_dra
 
        FILE *fp;
 
-       if (access("/tmp/upgrade/ro_progress", R_OK) == 0) {
-               fp = fopen("/tmp/upgrade/ro_progress", "r");
-               if (fp) {
-                       if (fscanf(fp, "%d", &percent) == EOF)
-                               LOG("Error occurs at reading ro_progress");
-                       if (percent == -1 && *s_saved_percent > 0) {
-                               LOG("END ro update\n");
-                               fclose(fp);
-                               return -1;
-                       }
-                       if (percent < 0)
-                               percent = 0;
-                       if (percent > 0xffffff)
-                               percent = 0xffffff;
+       fp = fopen("/tmp/upgrade/ro_progress", "r");
+       if (fp) {
+               if (fscanf(fp, "%d", &percent) == EOF)
+                       LOG("Error occurs at reading ro_progress");
+               if (percent == -1 && *s_saved_percent > 0) {
+                       LOG("END ro update\n");
                        fclose(fp);
-               } else
-                       percent = *s_percent_to_draw;
+                       return -1;
+               }
+               if (percent < 0)
+                       percent = 0;
+               if (percent > 0xffffff)
+                       percent = 0xffffff;
+               fclose(fp);
+       } else {
+               LOG("fopen fail, error msg : %s\n", strerror(errno));
+               percent = *s_percent_to_draw;
        }
 
        if (*s_percent_to_draw < percent)

diff --git a/fota_gui_wearable/fota_gr_direct_ro_wearable.c b/fota_gui_wearable/fota_gr_direct_ro_wearable.c
index 8dc2ccf8a05d83aa80b25f73bf19d4f1e6349be4..7cd33ea592206217d3fb79e7e73668398e7e219e 100644 (file)
--- a/fota_gui_wearable/fota_gr_direct_ro_wearable.c
+++ b/fota_gui_wearable/fota_gr_direct_ro_wearable.c
@@ -434,23 +434,23 @@ int fota_gr_direct_ro_update_progress(void)
 
        FILE *fp;
 
-       if (access("/tmp/upgrade/ro_progress", R_OK) == 0) {
-               fp = fopen("/tmp/upgrade/ro_progress", "r");
-               if (fp) {
-                       if (fscanf(fp, "%d", &percent) == EOF)
-                               LOG("Error occurs at reading ro_progress");
-                       if (percent == -1 && s_saved_percent > 0) {
-                               LOG("END ro update\n");
-                               fclose(fp);
-                               return -1;
-                       }
-                       if (percent < 0)
-                               percent = 0;
-                       if (percent > 0xffffff)
-                               percent = 0xffffff;
+       fp = fopen("/tmp/upgrade/ro_progress", "r");
+       if (fp) {
+               if (fscanf(fp, "%d", &percent) == EOF)
+                       LOG("Error occurs at reading ro_progress");
+               if (percent == -1 && s_saved_percent > 0) {
+                       LOG("END ro update\n");
                        fclose(fp);
-               } else
-                       percent = s_percent_to_draw;
+                       return -1;
+               }
+               if (percent < 0)
+                       percent = 0;
+               if (percent > 0xffffff)
+                       percent = 0xffffff;
+               fclose(fp);
+       } else {
+               LOG("fopen fail, error msg : %s\n", strerror(errno));
+               percent = s_percent_to_draw;
        }
 
        if (s_percent_to_draw < percent)

diff --git a/recovery_gui_common/recovery_gr_direct_common.c b/recovery_gui_common/recovery_gr_direct_common.c
index 2958eb728981a2c98c2a0d1fcf729f781b2cca06..fba3561c2fe12134e47f6b7c7a77ae05f3ad22c3 100644 (file)
--- a/recovery_gui_common/recovery_gr_direct_common.c
+++ b/recovery_gui_common/recovery_gr_direct_common.c
@@ -35,18 +35,18 @@ int fota_gr_direct_update_progress(int * s_saved_percent, int * s_percent_to_dra
 
        FILE *fp;
 
-       if (access("/tmp/recovery_progress", R_OK) == 0) {
-               fp = fopen("/tmp/recovery_progress", "r");
-               if (fp) {
-                       if (fscanf(fp, "%d", &percent) == EOF)
-                               LOG("Error occurs at reading progress");
-                       if (percent < 0)
-                               percent = 0;
-                       if (percent > 0xffffff)
-                               percent = 0xffffff;
-                       fclose(fp);
-               } else
-                       percent = *s_percent_to_draw;
+       fp = fopen("/tmp/recovery_progress", "r");
+       if (fp) {
+               if (fscanf(fp, "%d", &percent) == EOF)
+                       LOG("Error occurs at reading progress");
+               if (percent < 0)
+                       percent = 0;
+               if (percent > 0xffffff)
+                       percent = 0xffffff;
+               fclose(fp);
+       } else {
+               LOG("fopen fail, error msg : %s\n", strerror(errno));
+               percent = *s_percent_to_draw;
        }
 
        *s_percent_to_draw = percent;

diff --git a/rw-update-ani-common/fota_gr_direct_rw_common.c b/rw-update-ani-common/fota_gr_direct_rw_common.c
index 873c936364a2129dc21f40173cf8326ad2ce9cbe..21167c3d436cbaf84668e66d3ed38722cfd3012b 100644 (file)
--- a/rw-update-ani-common/fota_gr_direct_rw_common.c
+++ b/rw-update-ani-common/fota_gr_direct_rw_common.c
@@ -35,7 +35,7 @@ int fota_gr_direct_update_progress(int * s_saved_percent, int * s_percent_to_dra
        //static int b_text_drawn = 0;
        FILE *fp;
 
-       if (total <= 0 && access("/tmp/upgrade/total", R_OK) == 0) {
+       if (total <= 0) {
                fp = fopen("/tmp/upgrade/total", "r");
                if (fp) {
                        if (fscanf(fp, "%d", &total) == EOF)
@@ -45,22 +45,24 @@ int fota_gr_direct_update_progress(int * s_saved_percent, int * s_percent_to_dra
                        if (total > 0xffffff)
                                total = 0xffffff;
                        fclose(fp);
-               } else
+               } else {
+                       LOG("fopen fail, error msg : %s\n", strerror(errno));
                        total = 0;
+               }
        }
 
-       if (access("/tmp/upgrade/progress", R_OK) == 0) {
-               fp = fopen("/tmp/upgrade/progress", "r");
-               if (fp) {
-                       if (fscanf(fp, "%d", &progress) == EOF)
-                               LOG("Error occurs at reading progress");
-                       if (progress < 0)
-                               progress = 0;
-                       if (progress > total)
-                               progress = total;
-                       fclose(fp);
-               } else
+       fp = fopen("/tmp/upgrade/progress", "r");
+       if (fp) {
+               if (fscanf(fp, "%d", &progress) == EOF)
+                       LOG("Error occurs at reading progress");
+               if (progress < 0)
                        progress = 0;
+               if (progress > total)
+                       progress = total;
+               fclose(fp);
+       } else {
+               LOG("fopen fail, error msg : %s\n", strerror(errno));
+               progress = 0;
        }
 
        if (total == 0)

diff --git a/rw-update-ani-wearable/rw-update_new_fb_cairo.c b/rw-update-ani-wearable/rw-update_new_fb_cairo.c
index ed24012e722fe0b0cf9965d0b715a34ad2d03b71..8861e723e45c30ebcfa8b2a6ed474d25dd5c1838 100644 (file)
--- a/rw-update-ani-wearable/rw-update_new_fb_cairo.c
+++ b/rw-update-ani-wearable/rw-update_new_fb_cairo.c
@@ -23,6 +23,7 @@
 #include "rw-update_new_fb.h"
 #include <sys/ioctl.h>
 #include <unistd.h>
+#include <errno.h>
 
 #ifdef CAIRO_LIB
 #include "rw-update_new_cairo.h"
@@ -199,7 +200,7 @@ void fb_draw_screen(FbInfo *fbi)
        static int b_text_drawn = 0;
        FILE *fp;
 
-       if (total <= 0 && access("/tmp/upgrade/total", R_OK) == 0) {
+       if (total <= 0) {
                fp = fopen("/tmp/upgrade/total", "r");
                if (fp) {
                        if (fscanf(fp, "%d", &total) == EOF)
@@ -209,22 +210,24 @@ void fb_draw_screen(FbInfo *fbi)
                        if (total > 0xffffff)
                                total = 0xffffff;
                        fclose(fp);
-               } else
+               } else {
+                       _DEBUG_LOG("fopen fail, error msg : %s\n", strerror(errno));
                        total = 0;
+               }
        }
 
-       if (access("/tmp/upgrade/progress", R_OK) == 0) {
-               fp = fopen("/tmp/upgrade/progress", "r");
-               if (fp) {
-                       if (fscanf(fp, "%d", &progress) == EOF)
-                               _DEBUG_LOG("Error occurs at reading progress");
-                       if (progress < 0)
-                               progress = 0;
-                       if (progress > total)
-                               progress = total;
-                       fclose(fp);
-               } else
+       fp = fopen("/tmp/upgrade/progress", "r");
+       if (fp) {
+               if (fscanf(fp, "%d", &progress) == EOF)
+                       _DEBUG_LOG("Error occurs at reading progress");
+               if (progress < 0)
                        progress = 0;
+               if (progress > total)
+                       progress = total;
+               fclose(fp);
+       } else {
+               _DEBUG_LOG("fopen fail, error msg : %s\n", strerror(errno));
+               progress = 0;
        }
 
        _DEBUG_LOG("progress: %d/%d", progress, total);