[FIX] prevent issues 03/29103/2
authorVitaliy Cherepanov <v.cherepanov@samsung.com>
Tue, 21 Oct 2014 11:24:35 +0000 (15:24 +0400)
committerVitaliy Cherepanov <v.cherepanov@samsung.com>
Tue, 21 Oct 2014 11:47:08 +0000 (15:47 +0400)
|-------------------------|--------------------------------|
| Type                    | Function                       |
|-------------------------|--------------------------------|
| Calling risky function  | get_partition_sector_size      |
| Calling risky function  | find_pid_from_path             |
| Calling risky function  | wake_up_buf                    |
| Calling risky function  | flush_buf                      |
| Calling risky function  | kill_app                       |
| Calling risky function  | ioctl_send_msg                 |
| Calling risky function  | write_to_buf                   |
| Calling risky function  | sendACKToHost                  |
| Calling risky function  | get_max_brightness             |
| Calling risky function  | send_reply                     |
| Calling risky function  | start_profiling                |
| Calling risky function  | open_tasks_dev                 |
| Calling risky function  | _get_fds                       |
| Calling risky function  | open_buf_ctl                   |
| Calling risky function  | init_brightness_status         |
| Calling risky function  | get_other_pid_array            |
| Calling risky function  | exit_buf                       |
| Calling risky function  | init_buf                       |
| Calling risky function  | update_thread_data             |
| Calling risky function  | transfer_thread                |
| Calling risky function  | parse_proc_smaps_file_bypid    |
| Calling risky function  | parse_proc_stat_file_bypid     |
| Calling risky function  | update_process_data            |
| Calling risky function  | update_system_cpu_frequency    |
| Calling risky function  | get_device_network_type        |
| Calling risky function  | binary_ack_pack                |
| Calling risky function  | feature_code_str               |
| Calling risky function  | find_alternative_bin_path      |
| Calling risky function  | exec_app_common                |
| Calling risky function  | dereference_tizen_exe_path     |
| Calling risky function  | is_same_app_process            |
| Calling risky function  | makeTargetServerSocket         |
| Calling risky function  | host_message_handler           |
| Calling risky function  | targetServerHandler            |
| Calling risky function  | suffix_filename                |
| Calling risky function  | check_input                    |
| Calling risky function  | get_process_cmd_line           |
| Calling risky function  | get_lpad_pid                   |
|-------------------------|--------------------------------|

Change-Id: Ia50a7c4b4dc4a35ea11266a4dbdae7b522b1df94
Signed-off-by: Vitaliy Cherepanov <v.cherepanov@samsung.com>
daemon/buffer.c
daemon/da_protocol.c
daemon/daemon.c
daemon/debug.h
daemon/elf.c
daemon/input_events.c
daemon/ioctl_commands.c
daemon/main.c
daemon/sys_stat.c
daemon/transfer_thread.c
daemon/utils.c

index 14aa759..e304cd4 100644 (file)
@@ -45,7 +45,8 @@ static int open_tasks_dev(void)
        if (manager.fd.inst_tasks == NULL) {
                manager.fd.inst_tasks = fopen(INST_PID_FILENAME, "re");
                if (manager.fd.inst_tasks == NULL) {
-                       LOGE("Cannot open tasks dev: %s\n", strerror(errno));
+                       GETSTRERROR(errno, buf);
+                       LOGE("Cannot open tasks dev: %s\n", buf);
                        return 1;
                }
                LOGI("tasks dev opened: %s, %d\n", BUF_FILENAME, manager.buf_fd);
@@ -71,14 +72,16 @@ static int open_buf_ctl(void)
 {
        manager.buf_fd = open(BUF_FILENAME, O_RDONLY | O_CLOEXEC);
        if (manager.buf_fd == -1) {
-               LOGE("Cannot open buffer: %s\n", strerror(errno));
+               GETSTRERROR(errno, buf);
+               LOGE("Cannot open buffer: %s\n", buf);
                return 1;
        }
        LOGI("buffer opened: %s, %d\n", BUF_FILENAME, manager.buf_fd);
 
        manager.user_ev_fd = open(USER_EVENT_FILENAME, O_WRONLY | O_CLOEXEC);
        if (manager.user_ev_fd == -1) {
-               LOGE("Cannot open user event sysfs file: %s\b", strerror(errno));
+               GETSTRERROR(errno, buf);
+               LOGE("Cannot open user event sysfs file: %s\n", buf);
                return 1;
        }
        LOGI("user event sysfs file opened: %s, %d\n", USER_EVENT_FILENAME,
@@ -124,12 +127,14 @@ int init_buf(void)
        }
 
        if (ioctl(manager.buf_fd, SWAP_DRIVER_BUFFER_INITIALIZE, &init) == -1) {
-               LOGE("Cannot init buffer: %s\n", strerror(errno));
+               GETSTRERROR(errno, buf);
+               LOGE("Cannot init buffer: %s\n", buf);
                return 1;
        }
 
        if (open_tasks_dev() != 0) {
-               LOGE("Cannot open tasks: %s\n", strerror(errno));
+               GETSTRERROR(errno, buf);
+               LOGE("Cannot open tasks: %s\n", buf);
                return 1;
        }
 
@@ -139,8 +144,10 @@ int init_buf(void)
 void exit_buf(void)
 {
        LOGI("Uninit driver (%d)\n", manager.buf_fd);
-       if (ioctl(manager.buf_fd, SWAP_DRIVER_BUFFER_UNINITIALIZE) == -1)
-               LOGW("Cannot uninit driver: %s\n", strerror(errno));
+       if (ioctl(manager.buf_fd, SWAP_DRIVER_BUFFER_UNINITIALIZE) == -1) {
+               GETSTRERROR(errno, buf);
+               LOGW("Cannot uninit driver: %s\n", buf);
+       }
 
        close_buf_ctl();
        close_tasks_dev();
@@ -148,14 +155,18 @@ void exit_buf(void)
 
 void flush_buf(void)
 {
-       if (ioctl(manager.buf_fd, SWAP_DRIVER_FLUSH_BUFFER) == -1)
-               LOGW("Cannot send flush to driver: %s\n", strerror(errno));
+       if (ioctl(manager.buf_fd, SWAP_DRIVER_FLUSH_BUFFER) == -1) {
+               GETSTRERROR(errno, buf);
+               LOGW("Cannot send flush to driver: %s\n", buf);
+       }
 }
 
 void wake_up_buf(void)
 {
-       if (ioctl(manager.buf_fd, SWAP_DRIVER_WAKE_UP) == -1)
-               LOGW("Cannot send wake up to driver: %s\n", strerror(errno));
+       if (ioctl(manager.buf_fd, SWAP_DRIVER_WAKE_UP) == -1) {
+               GETSTRERROR(errno, buf);
+               LOGW("Cannot send wake up to driver: %s\n", buf);
+       }
 }
 
 int write_to_buf(struct msg_data_t *msg)
@@ -163,8 +174,9 @@ int write_to_buf(struct msg_data_t *msg)
        uint32_t total_len = MSG_DATA_HDR_LEN + msg->len;
 
        if (write(manager.user_ev_fd, msg, total_len) == -1) {
+               GETSTRERROR(errno, buf);
                LOGE("write to buf (user_ev_fd=%d, msg=%p, len=%d) %s\n",
-                    manager.user_ev_fd, msg, total_len, strerror(errno));
+                    manager.user_ev_fd, msg, total_len, buf);
                return 1;
        }
        return 0;
index d305f35..c4fa14b 100644 (file)
@@ -145,14 +145,21 @@ static char *msgErrStr(enum ErrorCode err)
 }
 
 
-#define print_feature(f,in,to,delim)           \
-       if (f & in) {                           \
-               sprintf(to, dstr(f) delim );    \
-               to+=strlen( dstr(f) delim );    \
+#define print_feature(f,in,to,delim)                                   \
+       if (f & in) {                                                   \
+               if (strlen(dstr(f) delim) + 1 < buflen ) {              \
+                       lenin = snprintf(to, buflen, dstr(f) delim );   \
+                       to += lenin;                                    \
+                       buflen -= lenin;                                \
+               } else {                                                \
+                       goto err_exit;                                  \
+               }                                                       \
        }
 #define print_feature_0(f) print_feature(f, feature0, to, ", \n\t")
-static void feature_code_str(uint64_t feature0, uint64_t feature1, char *to)
+static void feature_code_str(uint64_t feature0, uint64_t feature1, char *to,
+                            uint32_t buflen)
 {
+       int lenin = 0;
        print_feature_0(FL_FUNCTION_PROFILING);
        print_feature_0(FL_MEMORY_ALLOC_PROBING);
        print_feature_0(FL_FILE_API_PROBING);
@@ -186,6 +193,12 @@ static void feature_code_str(uint64_t feature0, uint64_t feature1, char *to)
        print_feature_0(FL_SYSTEM_NETWORK);
        print_feature_0(FL_SYSTEM_DEVICE);
        print_feature_0(FL_SYSTEM_ENERGY);
+
+       goto exit;
+err_exit:
+       LOGE("Not enought mem to print\n");
+exit:
+       return;
 }
 
 
@@ -564,7 +577,8 @@ static int send_reply(struct msg_t *msg)
        printBuf((char *)msg, msg->len + sizeof (*msg));
        if (send(manager.host.control_socket,
                 msg, MSG_CMD_HDR_LEN + msg->len, MSG_NOSIGNAL) == -1) {
-               LOGE("Cannot send reply : %s\n", strerror(errno));
+               GETSTRERROR(errno, buf);
+               LOGE("Cannot send reply : %s\n", buf);
                return -1;
        }
 
@@ -635,7 +649,8 @@ int sendACKToHost(enum HostMessageT resp, enum ErrorCode err_code,
 
                if (send(manager.host.control_socket, msg,
                         loglen, MSG_NOSIGNAL) == -1) {
-                       LOGE("Cannot send reply: %s\n", strerror(errno));
+                       GETSTRERROR(errno, buf);
+                       LOGE("Cannot send reply: %s\n", buf);
                        free(msg);
                        return 1;
                }
@@ -761,7 +776,7 @@ static size_t binary_ack_pack(char *s, const struct binary_ack *ba)
        s += len;
 
        for (i = 0; i!= 16; ++i) {
-               sprintf(s, "%02x", ba->digest[i]);
+               snprintf(s, 2, "%02x", ba->digest[i]);
                s += 2;
        }
        *s = '\0';
@@ -1045,7 +1060,7 @@ static char *get_process_cmd_line(uint32_t pid)
        int f;
        ssize_t count;
 
-       sprintf(buf, "/proc/%u/cmdline", pid);
+       snprintf(buf, sizeof(buf), "/proc/%u/cmdline", pid);
        f = open(buf, O_RDONLY);
        if (f != -1) {
                count = read(f, buf, sizeof(buf));
@@ -1206,8 +1221,10 @@ int host_message_handler(struct msg_t *msg)
                sendACKToHost(msg->id, ERR_NO, 0, 0);
                // send config message to target process
                sendlog.type = MSG_OPTION;
-               sendlog.length = sprintf(sendlog.data, "%llu",
-                                    (unsigned long long) prof_session.conf.use_features0);
+               sendlog.length = snprintf(sendlog.data, sizeof(sendlog.data),
+                                         "%llu",
+                                         (unsigned long long)
+                                         prof_session.conf.use_features0) + 1;
                target_send_msg_to_all(&sendlog);
                break;
        case NMSG_BINARY_INFO:
@@ -1276,7 +1293,7 @@ static void print_conf(struct conf_t *conf)
 {
        char buf[1024];
        memset(&buf[0], 0, 1024);
-       feature_code_str(conf->use_features0, conf->use_features1, buf);
+       feature_code_str(conf->use_features0, conf->use_features1, buf, sizeof(buf));
        LOGI("conf = \n");
        LOGI("\tuse_features = 0x%016LX : 0x%016LX \n(\t%s)\n",
             conf->use_features0, conf->use_features1, buf);
index 785d6ff..73eb781 100644 (file)
@@ -364,9 +364,10 @@ int start_profiling(void)
        }
        // remove previous screen capture files
        remove_indir(SCREENSHOT_DIR);
-       if (mkdir(SCREENSHOT_DIR, 0777) == -1 && errno != EEXIST)
-               LOGW("Failed to create directory for screenshot : %s\n",
-                    strerror(errno));
+       if (mkdir(SCREENSHOT_DIR, 0777) == -1 && errno != EEXIST) {
+               GETSTRERROR(errno, buf);
+               LOGW("Failed to create directory for screenshot : %s\n", buf);
+       }
 
        set_label_for_all(SCREENSHOT_DIR);
 
@@ -476,7 +477,7 @@ static pid_t get_lpad_pid(pid_t pid)
                char fname[64];
                char buf[lpad_path_len];
 
-               sprintf(fname, "/proc/%d/cmdline", pid);
+               snprintf(fname, sizeof(fname), "/proc/%d/cmdline", pid);
                if (-1 == file2str(fname, buf, lpad_path_len))
                        return lpad_pid;
 
@@ -638,8 +639,8 @@ static int targetServerHandler(void)
        if (err == 0) {
                /* send config message to target process */
                log.type = MSG_OPTION;
-               log.length = sprintf(log.data, "%llu\0",
-                                    prof_session.conf.use_features0) + 1;
+               log.length = snprintf(log.data, sizeof(log.data), "%llu",
+                                     prof_session.conf.use_features0) + 1;
                if (target_send_msg(target, &log) != 0)
                        LOGE("fail to send data to target %p\n", target);
 
index 82425c7..49de7b5 100644 (file)
@@ -63,6 +63,10 @@ void print_buf(char *buf, int len, const char *info);
 #endif
 
 #ifdef DEBUG
+#define GETSTRERROR(err_code, buf)                             \
+       char buf[256];                                          \
+       strerror_r(err_code, buf, sizeof(buf))
+
 #define LOGE(...) do_log("ERR", __func__, __LINE__, __VA_ARGS__)
 #define LOGW(...) do_log("WRN", __func__, __LINE__, __VA_ARGS__)
 
@@ -109,6 +113,7 @@ static inline void do_log(const char *prefix, const char *funcname, int line, ..
 
        #endif
 #else
+       #define GETSTRERROR(...)
        #define LOGI(...)
        #define LOGI_(...)
        #define LOGE(...)
index 7f5c6d8..2a624cb 100644 (file)
@@ -138,10 +138,13 @@ static bool exist(const char *filename)
 static void suffix_filename(char buf[PATH_MAX], const char *filename)
 {
        char adj_filename[PATH_MAX];
-       sprintf(adj_filename, "%s.exe", filename);
+       snprintf(adj_filename, sizeof(adj_filename), "%s.exe", filename);
        const char *use_filename = exist(adj_filename) ? adj_filename
                                                       : filename;
-       strcpy(buf, use_filename);
+       size_t len = strlen(use_filename) + 1;
+       strncpy(buf, use_filename, len);
+       if (len > strlen(buf) + 1)
+               LOGE("too small buf <%s>\n", buf);
 }
 
 void get_build_dir(char builddir[PATH_MAX], const char *filename)
index 8085e2f..2a02bec 100644 (file)
@@ -105,7 +105,9 @@ static int check_input(char *inputname, int input_id)
        char **name_arr;
        size_t bytes_count;
 
-       sprintf(command, "/sys/class/input/%s/device/name", inputname);
+       if (snprintf(command, sizeof(command), "/sys/class/input/%s/device/name",
+                    inputname) >= sizeof(command))
+               LOGE("too small buffer\n");
        // run command
        cmd_fp = fopen(command, "r");
        if (cmd_fp == NULL)
@@ -147,19 +149,22 @@ static void _get_fds(input_dev *dev, int input_id)
        DIR *dp;
        struct dirent *d;
        int count = 0;
+       static char dirent_buffer[ sizeof(struct dirent) + PATH_MAX + 1 ] = {0,};
+       static struct dirent *dirent_r = (struct dirent *)dirent_buffer;
+
 
        dp = opendir("/sys/class/input");
 
        if (dp == NULL)
                goto exit;
 
-       while ((d = readdir(dp)) != NULL) {
+       while ((readdir_r(dp, dirent_r, &d) == 0) && d) {
                if (!strncmp(d->d_name, "event", 5)) {
                        // start with "event"
                        // event file
                        if (!check_input(d->d_name, input_id)) {
-                               sprintf(dev[count].fileName,
-                                       "/dev/input/%s", d->d_name);
+                               snprintf(dev[count].fileName, MAX_FILENAME,
+                                        "/dev/input/%s", d->d_name);
                                dev[count].fd = open(dev[count].fileName,
                                                     O_RDWR | O_NONBLOCK);
                                count++;
index 5e24b0d..f617170 100644 (file)
@@ -40,7 +40,8 @@ int ioctl_send_msg(struct msg_t *msg)
 {
        LOGI("write to device\n");
        if (ioctl(manager.buf_fd, SWAP_DRIVER_MSG, msg) == -1) {
-               LOGE("write to device: %s\n", strerror(errno));
+               GETSTRERROR(errno, buf);
+               LOGE("write to device: %s\n", buf);
                return 1;
        }
        return 0;
index d545b8c..11ba899 100644 (file)
@@ -156,7 +156,7 @@ static int makeTargetServerSocket()
 
        memset(&serverAddrUn, '\0', sizeof(serverAddrUn));
        serverAddrUn.sun_family = AF_UNIX;
-       sprintf(serverAddrUn.sun_path, "%s", UDS_NAME);
+       snprintf(serverAddrUn.sun_path, sizeof(serverAddrUn.sun_path), "%s", UDS_NAME);
 
        if (-1 == bind(manager.target_server_socket, (struct sockaddr*) &serverAddrUn,
                                        sizeof(serverAddrUn)))
index 1efdbc4..57afccb 100644 (file)
@@ -178,18 +178,21 @@ static void init_brightness_status()
        DIR *dir_info;
        struct dirent *dir_entry;
        char fullpath[PATH_MAX];
+       static char dirent_buffer[ sizeof(struct dirent) + PATH_MAX + 1 ] = {0,};
+       static struct dirent *dirent_r = (struct dirent *)dirent_buffer;
+
 
        dir_info = opendir(BRIGHTNESS_PARENT_DIR);
        if (dir_info != NULL) {
-               while ((dir_entry = readdir(dir_info)) != NULL) {
+               while ((readdir_r(dir_info, dirent_r, &dir_entry) == 0) && dir_entry) {
                        if (strcmp(dir_entry->d_name, ".") == 0 ||
                            strcmp(dir_entry->d_name, "..") == 0)
                                continue;
                        else { /* first directory */
-                               sprintf(fullpath,
-                                       BRIGHTNESS_PARENT_DIR "/%s/"
-                                       BRIGHTNESS_FILENAME,
-                                       dir_entry->d_name);
+                               snprintf(fullpath, sizeof(fullpath),
+                                        BRIGHTNESS_PARENT_DIR "/%s/"
+                                        BRIGHTNESS_FILENAME,
+                                        dir_entry->d_name);
                                get_file_status(&manager.fd.brightness,
                                                fullpath);
                        }
@@ -212,6 +215,8 @@ static int get_max_brightness()
 {
        int maxbrightnessfd = -1;
        static int max_brightness = -1;
+       static char dirent_buffer[ sizeof(struct dirent) + PATH_MAX + 1 ] = {0,};
+       static struct dirent *dirent_r = (struct dirent *)dirent_buffer;
 
        if (__builtin_expect(max_brightness < 0, 0)) {
 #ifdef DEVICE_ONLY
@@ -221,14 +226,14 @@ static int get_max_brightness()
 
                dir_info = opendir(BRIGHTNESS_PARENT_DIR);
                if (dir_info != NULL) {
-                       while((dir_entry = readdir(dir_info)) != NULL) {
+                       while ((readdir_r(dir_info, dirent_r, &dir_entry) == 0) && dir_entry) {
                                if (strcmp(dir_entry->d_name, ".") == 0 ||
                                    strcmp(dir_entry->d_name, "..") == 0)
                                        continue;
                                else { /* first */
-                                       sprintf(fullpath,
-                                               BRIGHTNESS_PARENT_DIR "/%s/" MAX_BRIGHTNESS_FILENAME,
-                                               dir_entry->d_name);
+                                       snprintf(fullpath, sizeof(fullpath),
+                                                BRIGHTNESS_PARENT_DIR "/%s/" MAX_BRIGHTNESS_FILENAME,
+                                                dir_entry->d_name);
                                        max_brightness = get_file_status(&maxbrightnessfd, fullpath);
                                }
                        }
@@ -500,7 +505,7 @@ static int parse_proc_stat_file_bypid(char *path, proc_t* P, int is_inst_process
        char *abuf, *bbuf;
 
        // read from stat file
-       sprintf(filename, "%s/stat", path);
+       snprintf(filename, sizeof(filename), "%s/stat", path);
        fd = open(filename, O_RDONLY, 0);
 
        if(unlikely(fd == -1)){
@@ -595,7 +600,7 @@ static int parse_proc_smaps_file_bypid(char *path, proc_t* P)
        P->sh_mem = 0;
 
        // read from smaps file
-       sprintf(filename, "%s/smaps", path);
+       snprintf(filename, sizeof(filename), "%s/smaps", path);
        fp = fopen(filename, "r");
 
        if(fp == NULL){
@@ -698,7 +703,7 @@ static int update_process_data(procNode **prochead, pid_t* pidarray, int pidcoun
                        continue;
                }
 
-               sprintf(buf, "/proc/%d", pidarray[i]);
+               snprintf(buf, sizeof(buf), "/proc/%d", pidarray[i]);
                if (unlikely(stat(buf, &sb) == -1))     // cannot access anymore
                {
                        del_node(prochead, pidarray[i]);
@@ -778,7 +783,7 @@ static int update_system_cpu_frequency(int cur_index)
                }
        }
 
-       sprintf(filename, CPUNUM_OF_FREQ);
+       snprintf(filename, sizeof(filename), CPUNUM_OF_FREQ);
        // update cpu frequency information
        for(i = 0; i < num_of_cpu; i++)
        {
@@ -1143,8 +1148,10 @@ static int update_thread_data(int pid)
        unsigned int tid;
        procNode *node = NULL;
        procNode **thread_prochead = NULL;
+       static char dirent_buffer[ sizeof(struct dirent) + PATH_MAX + 1 ] = {0,};
+       static struct dirent *dirent_r = (struct dirent *)dirent_buffer;
 
-       sprintf(path, "/proc/%d/task", pid);
+       snprintf(path, sizeof(path), "/proc/%d/task", pid);
 
        if(!(taskdir = opendir(path)))
        {
@@ -1161,12 +1168,11 @@ static int update_thread_data(int pid)
        }
        thread_prochead = (procNode **)&(node->thread_prochead);
 
-       while((entry = readdir(taskdir)) != NULL)
-       {
+       while ((readdir_r(taskdir, dirent_r, &entry) == 0) && entry) {
                if(*entry->d_name > '0' &&      *entry->d_name <= '9')
                {
                        tid = atoi(entry->d_name);
-                       sprintf(buf, "/proc/%d/task/%d", pid, tid);
+                       snprintf(buf, sizeof(buf), "/proc/%d/task/%d", pid, tid);
 
                        if(unlikely(stat(buf, &sb) == -1))
                        {
@@ -1212,40 +1218,54 @@ exit:
 // overall information getter functions
 // ========================================================================
 
-static int get_device_network_type(char* buf, int buflen)
+#define print_to_buf(buf, buflen, str)                         \
+do {                                                           \
+       if (strlen(str) <= buflen) {                            \
+               lenin = snprintf(buf, buflen, "CDMA,");         \
+               len += lenin;                                   \
+               buflen -= lenin;                                \
+       } else {                                                \
+               LOGE("can not pack <%s>\n", str);               \
+               goto exit;                                      \
+       }                                                       \
+} while(1)
+
+static int get_device_network_type(char* buf, size_t buflen)
 {
-       int len = 0;
+       int len = 0, lenin = 0;
+
 
        if (is_cdma_available())
-               len += sprintf(buf + len, "CDMA,");
+               print_to_buf(buf, buflen, "CDMA,");
 
        if (is_edge_available())
-               len += sprintf(buf + len, "EDGE,");
+               print_to_buf(buf, buflen, "EDGE,");
 
        if (is_gprs_available())
-               len += sprintf(buf + len, "GPRS,");
+               print_to_buf(buf, buflen, "GPRS,");
 
        if (is_gsm_available())
-               len += sprintf(buf + len, "GSM,");
+               print_to_buf(buf, buflen, "GSM,");
 
        if (is_hsdpa_available())
-               len += sprintf(buf + len, "HSDPA,");
+               print_to_buf(buf, buflen, "HSDPA,");
 
        if (is_hspa_available())
-               len += sprintf(buf + len, "HSPA,");
+               print_to_buf(buf, buflen, "HSPA,");
 
        if (is_hsupa_available())
-               len += sprintf(buf + len, "HSUPA,");
+               print_to_buf(buf, buflen, "HSUPA,");
 
        if (is_umts_available())
-               len += sprintf(buf + len, "UMTS,");
+               print_to_buf(buf, buflen, "UMTS,");
 
        if (is_lte_available())
-               len += sprintf(buf + len, "LTE,");
+               print_to_buf(buf, buflen, "LTE,");
 
        if (len != 0)
                buf[--len] = 0;
 
+exit:
        return len;
 }
 
@@ -1541,7 +1561,7 @@ static uint32_t get_partition_sector_size(char *partition_name)
        uint32_t res = 0;
 
        /* prepare partition sector size file name */
-       sprintf(buf, "/sys/block/%s/queue/hw_sector_size", partition_name);
+       snprintf(buf, MAX_FILENAME, "/sys/block/%s/queue/hw_sector_size", partition_name);
        f = fopen(buf, "r");
 
        /* check file */
@@ -1553,8 +1573,8 @@ static uint32_t get_partition_sector_size(char *partition_name)
                        /* check errors */
                        int errsv = errno;
                        if (errsv) {
-                               LOGE("scan file <%s> error: %s\n", buf,
-                                    strerror(errsv));
+                               GETSTRERROR(errsv, errno_buf);
+                               LOGE("scan file <%s> error: %s\n", buf, errno_buf);
                                res = 0;
                        }
                }
@@ -1824,13 +1844,16 @@ static int get_other_pid_array(pid_t inst_pid[], const int inst_n, pid_t arr[],
        DIR *d = opendir("/proc");
        struct dirent *dirent;
        int count = 0, i = 0;
+       static char dirent_buffer[ sizeof(struct dirent) + PATH_MAX + 1 ] = {0,};
+       static struct dirent *dirent_r = (struct dirent *)dirent_buffer;
 
        if (!d) {
-               LOGW("Cannot open /proc dir (%s)\n", strerror(errno));
+               GETSTRERROR(errno, buf);
+               LOGW("Cannot open /proc dir (%s)\n", buf);
                return 0;
        }
 
-       while ((dirent = readdir(d)) && (count < n)) {
+       while ((readdir_r(d, dirent_r, &dirent) == 0) && dirent) {
                if (dirent->d_type == DT_DIR) {
                        char *tmp;
                        pid_t pid = strtol(dirent->d_name, &tmp, 10);
index ef4dc85..60fd1f4 100644 (file)
@@ -77,11 +77,13 @@ static void *transfer_thread(void *arg)
                             fd_pipe[1], NULL,
                             BUF_SIZE, 0);
                if (nrd == -1) {
-                       if (errno == EAGAIN) {
+                       int errsv = errno;
+                       if (errsv == EAGAIN) {
                                LOGI("No more data to read\n");
                                break;
                        }
-                       LOGE("Cannot splice read: %s\n", strerror(errno));
+                       GETSTRERROR(errsv, err_buf);
+                       LOGE("Cannot splice read: %s\n", err_buf);
                        goto thread_exit;
                }
 
@@ -90,7 +92,8 @@ static void *transfer_thread(void *arg)
                             nrd, 0);
 
                if (nwr == -1) {
-                       LOGE("Cannot splice write: %s\n", strerror(errno));
+                       GETSTRERROR(errno, buf);
+                       LOGE("Cannot splice write: %s\n", buf);
                        goto thread_exit;
                }
                if (nwr != nrd) {
index b6c88c7..05d3374 100644 (file)
@@ -177,7 +177,7 @@ int exec_app_common(const char* exec_path)
                return -1;
        }
 
-       sprintf(command, "%s %s", DA_PRELOAD_TIZEN, exec_path);
+       snprintf(command, sizeof(command), "%s %s", DA_PRELOAD_TIZEN, exec_path);
        LOGI("cmd: %s\n", command);
 
        pid = fork();
@@ -260,6 +260,8 @@ static pid_t find_pid_from_path(const char *path)
        char cmdline[PATH_MAX];
        DIR *proc;
        FILE *fp;
+       static char dirent_buffer[ sizeof(struct dirent) + PATH_MAX + 1 ] = {0,};
+       static struct dirent *dirent_r = (struct dirent *)dirent_buffer;
        struct dirent *entry;
        int found, len = strlen(path);
        pid_t pid = 0;
@@ -270,7 +272,7 @@ static pid_t find_pid_from_path(const char *path)
        if (!proc)
                goto out;
 
-       while ((entry = readdir(proc)) != NULL) {
+       while ((readdir_r(proc, dirent_r, &entry) == 0) && entry) {
                pid = (pid_t)atoi(entry->d_name);
                if (pid == 0)
                        continue;
@@ -333,14 +335,22 @@ static pid_t get_pid_by_path(const char *binary_path)
        return pkg_pid;
 }
 
-static int find_alternative_bin_path(const char *binary_path, char *alter_bin_path) {
+static int find_alternative_bin_path(const char *binary_path, char *alter_bin_path,
+          size_t  buflen)
+{
        // alternative path may be /opt/apps/... or /opt/usr/apps/...)
+       char *add_fname;
+       char *p;
        if (strncmp(binary_path, APPDIR1, strlen(APPDIR1)) == 0) {
-               strcpy(alter_bin_path, APPDIR2);
-               strcat(alter_bin_path, binary_path + strlen(APPDIR1));
+               strncpy(alter_bin_path, APPDIR2, buflen);
+               buflen -= strlen(alter_bin_path);
+               add_fname = binary_path + strlen(APPDIR1);
+               strncat(alter_bin_path, add_fname, buflen);
        } else if (strncmp(binary_path, APPDIR2, strlen(APPDIR2)) == 0) {
-               strcpy(alter_bin_path, APPDIR1);
-               strcat(alter_bin_path, binary_path + strlen(APPDIR2));
+               strncpy(alter_bin_path, APPDIR1, buflen);
+               buflen -= strlen(alter_bin_path);
+               add_fname = binary_path + strlen(APPDIR2);
+               strncat(alter_bin_path, add_fname, buflen);
        } else {
                return 1;
        }
@@ -357,14 +367,15 @@ int kill_app(const char *binary_path)
        pkg_pid = get_pid_by_path(binary_path);
 
        if (pkg_pid == 0) {
-               if (find_alternative_bin_path(binary_path, alter_bin_path) == 0)
+               if (find_alternative_bin_path(binary_path, alter_bin_path, PATH_MAX) == 0)
                        pkg_pid = get_pid_by_path(alter_bin_path);
        }
 
        if (pkg_pid != 0) {
                if (kill(pkg_pid, SIGTERM) == -1) {
-                       LOGE("cannot kill %d -%d err<%s>\n", pkg_pid, SIGKILL,
-                            strerror(errno));
+                       GETSTRERROR(errno, err_buf);
+                       LOGE("cannot kill %d -%d errno<%s>\n", pkg_pid, SIGKILL,
+                            err_buf);
                        return -1;
                } else {
                        // we need sleep up there because kill() function
@@ -400,7 +411,7 @@ int is_same_app_process(char* appPath, int pid)
                tPath[tlen - 4] = '\0';
        }
 
-       sprintf(cmdPath, "/proc/%d/cmdline", pid);
+       snprintf(cmdPath, sizeof(cmdPath), "/proc/%d/cmdline", pid);
 
        if((fp = fopen(cmdPath, "r")) == NULL)
        {
@@ -436,7 +447,7 @@ static char *dereference_tizen_exe_path(const char *path, char *resolved)
 
        resolved[0] = 0;
        //try resolve <path>.exe
-       sprintf(tmp_path, "%s.exe", path);
+       snprintf(tmp_path, sizeof(tmp_path), "%s.exe", path);
        if ((res = realpath(tmp_path, resolved)) == NULL) {
                //try to resolve path <path>
                res = realpath(path, resolved);