Fix vulnerabilities

Change-Id: I0499762ff502b51ac4e5ae384a67640cc89e322a
Signed-off-by: Sunmin Lee <sunm.lee@samsung.com>

diff --git a/fota_gui/fota_gui_log.h b/fota_gui/fota_gui_log.h
index f99e19a..5060e7e 100755 (executable)
--- a/fota_gui/fota_gui_log.h
+++ b/fota_gui/fota_gui_log.h
@@ -36,12 +36,12 @@ extern unsigned int __log_level__;
 extern FILE *__log_out_file__;
 
 #define LOG_INFO       (1<<8)
-#define LOG_REDBEND    (1<<7)
-#define LOG_FUNCS      (1<<6)
+#define LOG_SSENGINE   (1<<7)
+#define LOG_FUNCS      (1<<6)
 #define LOG_GUI                (1<<5)
-#define LOG_DEBUG      (1<<4)
-#define LOG_FILE       (1<<3)
-#define LOG_FLASH      (1<<2)
+#define LOG_DEBUG      (1<<4)
+#define LOG_FILE       (1<<3)
+#define LOG_FLASH      (1<<2)
 
 #define LOG_PRFIX      "FOTA_GUI"
 

diff --git a/fota_gui/fota_gui_main.c b/fota_gui/fota_gui_main.c
index 8c92ac5..4997254 100755 (executable)
--- a/fota_gui/fota_gui_main.c
+++ b/fota_gui/fota_gui_main.c
@@ -37,7 +37,7 @@
 
 
 unsigned int __log_level__ =
-       (LOG_DEBUG | LOG_FLASH | LOG_FILE | LOG_FUNCS | LOG_GUI | LOG_REDBEND | LOG_INFO);
+       (LOG_DEBUG | LOG_FLASH | LOG_FILE | LOG_FUNCS | LOG_GUI | LOG_SSENGINE | LOG_INFO);
 FILE *__log_out_file__;
 
 int s_prog_percent = 0;
@@ -74,13 +74,15 @@ int run_command(sock_cmd * recvbuff, sock_ack * sendbuff, int connfd)
                LOG("draw_progress selected\n");
                if (argc != 1) {
                        sendbuff->ack = MISSING_PARAM;
-                       strcpy(sendbuff->ack_desc, "Missing parameter");
+                       strncpy(sendbuff->ack_desc, "Missing parameter",
+                                       sizeof(sendbuff->ack_desc) - 1);
                        ret = send(connfd, sendbuff, sizeof(sock_ack), 0);
                } else {
                        LOG("argv[0]: %s\n", recvbuff->argv[0]);
                        ret = CMD_SUCCESS;
                        sendbuff->ack = ret;
-                       strcpy(sendbuff->ack_desc, "Command recieved");
+                       strncpy(sendbuff->ack_desc, "Command recieved",
+                                       sizeof(sendbuff->ack_desc) - 1);
                        ret = send(connfd, sendbuff, sizeof(sock_ack), 0);
 
                        val = atoi(recvbuff->argv[0]);
@@ -97,20 +99,23 @@ int run_command(sock_cmd * recvbuff, sock_ack * sendbuff, int connfd)
                LOG("draw_end selected\n");
                if (argc != 0) {
                        sendbuff->ack = MISSING_PARAM;
-                       strcpy(sendbuff->ack_desc, "Missing parameter");
+                       strncpy(sendbuff->ack_desc, "Missing parameter",
+                                       sizeof(sendbuff->ack_desc) - 1);
                        ret = send(connfd, sendbuff, sizeof(sock_ack), 0);
                } else {
                        LOG("argv[0]: %s\n", recvbuff->argv[0]);
                        ret = CMD_SUCCESS;
                        sendbuff->ack = ret;
-                       strcpy(sendbuff->ack_desc, "Command recieved");
+                       strncpy(sendbuff->ack_desc, "Command recieved",
+                                       sizeof(sendbuff->ack_desc) - 1);
                        ret = send(connfd, sendbuff, sizeof(sock_ack), 0);
                        do_exit = 1;
                }
        } else {
                LOG("Command Not Found \n");
                sendbuff->ack = MISSING_PARAM;
-               strcpy(sendbuff->ack_desc, "Command Not found");
+               strncpy(sendbuff->ack_desc, "Command Not found",
+                               sizeof(sendbuff->ack_desc) - 1);
                ret = send(connfd, sendbuff, sizeof(sock_ack), 0);
        }
 
@@ -154,7 +159,7 @@ int main(int argc, char **argv)
 
        memset((char *)&saddr, 0, sizeof(saddr));
        saddr.sun_family = AF_UNIX;
-       strcpy(saddr.sun_path, SERV_PATH);
+       strncpy(saddr.sun_path, SERV_PATH, sizeof(SERV_PATH) + 1);
        saddr.sun_path[sizeof(SERV_PATH)] = '\0';
        slen = sizeof(saddr);
 

diff --git a/fota_gui/fota_log.h b/fota_gui/fota_log.h
index b02af3c..a267c84 100755 (executable)
--- a/fota_gui/fota_log.h
+++ b/fota_gui/fota_log.h
@@ -29,12 +29,12 @@ extern unsigned int __log_level__;
 extern FILE *__log_out_file__;
 
 #define LOG_INFO       (1<<8)
-#define LOG_REDBEND    (1<<7)
-#define LOG_FUNCS      (1<<6)
+#define LOG_SSENGINE   (1<<7)
+#define LOG_FUNCS      (1<<6)
 #define LOG_GUI                (1<<5)
-#define LOG_DEBUG      (1<<4)
-#define LOG_FILE       (1<<3)
-#define LOG_FLASH      (1<<2)
+#define LOG_DEBUG      (1<<4)
+#define LOG_FILE       (1<<3)
+#define LOG_FLASH      (1<<2)
 
 #define LOG_PRFIX      "FOTA_GUI"
 

diff --git a/src/rpi3/ua.c b/src/rpi3/ua.c
index 51e986e..f67da1a 100644 (file)
--- a/src/rpi3/ua.c
+++ b/src/rpi3/ua.c
@@ -1089,6 +1089,10 @@ int fota_path_init(void)
 
        for(i = 0; i < s_part_num; i++) {
                s_update_data[i].ua_delta_path = malloc(MAX_FILE_PATH);
+               if (s_update_data[i].ua_delta_path == NULL) {
+                       LOG("Memory allocation fail\n");
+                       return FAIL;
+               }
                snprintf(s_update_data[i].ua_delta_path, MAX_FILE_PATH, "%s/%s", delta_folder, DEFAULT_DELTA_NAME);
                //s_update_data[i].ua_temp_path = malloc(MAX_FILE_PATH);
                //sprintf(s_update_data[i].ua_temp_path, "%s/fota_temp_%s", delta_folder, s_part_info[i].ua_parti_name);

diff --git a/src/tw1/ua.c b/src/tw1/ua.c
index 6e25c32..5c0d470 100755 (executable)
--- a/src/tw1/ua.c
+++ b/src/tw1/ua.c
@@ -516,7 +516,7 @@ int update_RecoveryDelta_IMG(int part_idx, int update_type)
        //ua_dataSS.update_data.ua_temp_path =
 
        if (ua_update_data->ua_delta_path != NULL && ua_dataSS.update_data->ua_temp_path) {
-               sprintf(ua_dataSS.update_data->ua_temp_path, "%s/fota_temp_%s", delta_folder, ua_dataSS.parti_info->ua_parti_name);
+               snprintf(ua_dataSS.update_data->ua_temp_path, MAX_FILE_PATH, "%s/fota_temp_%s", delta_folder, ua_dataSS.parti_info->ua_parti_name);
                LOG("update_RecoveryDelta_IMG() [%s] temp path [%s]\n", ua_dataSS.parti_info->ua_parti_name,ua_dataSS.update_data->ua_temp_path);
                ret = SS_IMGUpdatemain(&ua_dataSS, update_type);        //PASS temp path whr file has to be written, Once written it should be UNLINKED after upgrade.
                }
@@ -670,7 +670,7 @@ int write_num_to_file(const char *path, int num)
 {
        char num_str[16];
 
-       sprintf(num_str, "%d", num);
+       snprintf(num_str, sizeof(num_str), "%d", num);
        return write_to_file(path, num_str, strlen(num_str));
 }
 
@@ -739,7 +739,7 @@ static void get_time_stamp(void)
        gettimeofday(&tv, NULL);
        sec = (int) tv.tv_sec;
        msec = (int) (tv.tv_usec / 1000);
-       sprintf(ts, "%06d.%03d", sec % 100000, msec);
+       snprintf(ts, sizeof(ts), "%06d.%03d", sec % 100000, msec);
 }
 
 /*-----------------------------------------------------------------------------
@@ -907,7 +907,7 @@ void log_init(void)
        char log_file[MAX_FILE_PATH];
 
        memset(log_file, 0x00, sizeof(log_file));
-       sprintf(log_file, "%s%s", log_folder, LOG_FILE_PATH);
+       snprintf(log_file, sizeof(log_file), "%s%s", log_folder, LOG_FILE_PATH);
 
        __log_out_file__ = fopen(log_file, "w");
        if (__log_out_file__ == NULL) {
@@ -1012,7 +1012,7 @@ void save_cause(int cause)
                return;
        }
 
-       sprintf(return_char, "%x", cause);
+       snprintf(return_char, sizeof(return_char), "%x", cause);
        fwrite(return_char, strlen(return_char), 1, result_fp);
        fclose(result_fp);
 
@@ -1034,7 +1034,7 @@ void save_result(int result)
                return;
        }
 
-       sprintf(return_char, "%x", result);
+       snprintf(return_char, sizeof(return_char), "%x", result);
        fwrite(return_char, strlen(return_char), 1, result_fp);
        fclose(result_fp);
 
@@ -1057,15 +1057,19 @@ int fota_path_init(void)
 
        for(i = 0; i < s_part_num; i++) {
                s_update_data[i].ua_delta_path = malloc(MAX_FILE_PATH);
-               sprintf(s_update_data[i].ua_delta_path, "%s/%s", delta_folder, DEFAULT_DELTA_NAME);
+               if (s_update_data[i].ua_delta_path == NULL) {
+                       LOG("Memory allocation fail\n");
+                       return FAIL;
+               }
+               snprintf(s_update_data[i].ua_delta_path, MAX_FILE_PATH, "%s/%s", delta_folder, DEFAULT_DELTA_NAME);
                //will be filled by UA if required (eg : RAMDISK case in TOTA)
                //s_update_data[i].ua_temp_path = malloc(MAX_FILE_PATH);
                //sprintf(s_update_data[i].ua_temp_path, "%s/fota_temp_%s", delta_folder, s_part_info[i].ua_parti_name);
        }
 
-       sprintf(fota_result, "%s/%s", result_folder, "result");
-       sprintf(fota_cause, "%s/%s", result_folder, "cause");
-       sprintf(fota_status_path, "%s/%s", result_folder, UP_STATUS_FILE);
+       snprintf(fota_result, sizeof(fota_result), "%s/%s", result_folder, "result");
+       snprintf(fota_cause, sizeof(fota_cause), "%s/%s", result_folder, "cause");
+       snprintf(fota_status_path, sizeof(fota_status_path), "%s/%s", result_folder, UP_STATUS_FILE);
 
        for(i = 0; i < s_part_num; i++) {
                LOG("s_part_info[UA_%s].ua_delta_path=%s\n",
@@ -1369,7 +1373,7 @@ int main(int argc, char **argv)
 
        memset(delta_folder, 0x00, sizeof(delta_folder));
        snprintf(delta_folder, sizeof(delta_folder)-1, "%s", argv[1]);
-       sprintf(delta_path, "%s/%s", delta_folder, DEFAULT_DELTA_NAME);
+       snprintf(delta_path, sizeof(delta_path)-1, "%s/%s", delta_folder, DEFAULT_DELTA_NAME);
 
        memset(temp_folder, 0x00, sizeof(temp_folder));
        snprintf(temp_folder, sizeof(temp_folder)-1, "%s", argv[2]);