Fix vulnerabilities

- Replace vulnerable function with not the one
- Guarantee null termination in SS_ReadFile()

Change-Id: I32d1c68e95a488632d9084f13f45637745abc703
Signed-off-by: Sunmin Lee <sunm.lee@samsung.com>

diff --git a/ss_engine/SS_FSUpdate.c b/ss_engine/SS_FSUpdate.c
index d0def92..eb51585 100755 (executable)
--- a/ss_engine/SS_FSUpdate.c
+++ b/ss_engine/SS_FSUpdate.c
@@ -509,6 +509,7 @@ SS_ReadFile(long wHandle,
        if (ret != dwSize && ((ret + dwPosition) != (unsigned long)SS_GetFileSize(wHandle)))
                return E_SS_READ_ERROR;
 
+       pbBuffer[ret] = '\0';
 #if 0
        LOGL(LOG_DEBUG, "Bytes Read: %d\n", ret);
 #endif

diff --git a/ss_engine/SS_UPI.c b/ss_engine/SS_UPI.c
index 82072b7..b0b854a 100755 (executable)
--- a/ss_engine/SS_UPI.c
+++ b/ss_engine/SS_UPI.c
@@ -405,6 +405,7 @@ int SS_Get_last_update_status(int* last_update_status, int* del_type)
        int fd;
        unsigned char buf[256];
        char *ptr = NULL;
+       char *saveptr;
        int result = 0;
 
        if (file_exist(SS_UPDATE_STATUR_PATH) == 0) {
@@ -427,11 +428,11 @@ int SS_Get_last_update_status(int* last_update_status, int* del_type)
                return -1;
        }
 
-       ptr = strtok((char *)buf, " ");
+       ptr = strtok_r((char *)buf, " ", &saveptr);
 
        if (ptr != NULL) {
                *last_update_status = atoi(ptr);
-               ptr = strtok(NULL, " ");
+               ptr = strtok_r(NULL, " ", &saveptr);
        }
 
        if (ptr != NULL) {
@@ -458,7 +459,7 @@ void SS_Set_last_update_status(int last_update_status, int del_type)
                return;
        }
 
-       sprintf(num_str, "%d %d", last_update_status, del_type);
+       snprintf(num_str, sizeof(num_str), "%d %d", last_update_status, del_type);
        result = SS_WriteFile(fd, 0, (unsigned char *)num_str, strlen(num_str));
        if (result != 0)
                LOGE("SS_WriteFile failed!!\n");