Avoid the possibility of buffer overflow

Change-Id: I7394946366ace1d4fbc679824ee26b47143c816c
Signed-off-by: Hyunbin Lee <hyunbin.lee@samsung.com>

1 files changed, 44 insertions, 35 deletions

diff --git a/src/osp-env-config.c b/src/osp-env-config.c
index 5a93678..3030303 100644
--- a/src/osp-env-config.c
+++ b/src/osp-env-config.c
@@ -51,9 +51,10 @@
 #define _SECURE_LOGE(...)
 #endif
 
-static const char _OSP_COMPAT_SHARED_PATH[] = "/opt/usr/share/.osp-compat/\0";
-static const char _EXT_OSP_HOME_PATH[] = "/opt/storage/sdcard/osp/\0";
+static const char _OSP_COMPAT_SHARED_PATH[] = "/opt/usr/share/.osp-compat/";
+static const char _EXT_OSP_HOME_PATH[] = "/opt/storage/sdcard/osp/";
 static const char OSP_COMPAT_LIB[] = "/usr/lib/osp/libosp-compat.so";
+static const int MAX_PACKAGE_ID = NAME_MAX;
 
 struct _path_info
 {
@@ -80,9 +81,18 @@ get_app_rootpath_from_path(const char* bin_path)
 
 	/* e.g., The specified bin_path is "/opt/apps/com.samsung.basicapp/bin/basicapp" */
 	length = strlen(bin_path);
+	if (length > (PATH_MAX - 1))
+	{
+		LOGE("bin path (%s) is too long", bin_path);
+		return NULL;
+	}
+
 	app_rootpath = (char *)malloc(length + 1);
 	if(app_rootpath == NULL)
+	{
+		LOGE("malloc() failed, errno: %d (%s)", errno, strerror(errno));
 		return NULL;
+	}
 
 	memset(app_rootpath, '\0', length + 1);
 	strncpy(app_rootpath, bin_path, length);
@@ -268,14 +278,14 @@ mount_osp_internal_paths(const char* app_rootpath, const char* pkgid)
 
 	strncpy(osp_share_pkgid_path, _OSP_COMPAT_SHARED_PATH, strlen(_OSP_COMPAT_SHARED_PATH));
 	strncat(osp_share_pkgid_path, "share/", 6);
-	strncat(osp_share_pkgid_path, pkgid, strlen(pkgid));
+	strncat(osp_share_pkgid_path, pkgid, MAX_PACKAGE_ID);
 
 	strncpy(osp_share2_pkgid_path, _OSP_COMPAT_SHARED_PATH, strlen(_OSP_COMPAT_SHARED_PATH));
 	strncat(osp_share2_pkgid_path, "share2/", 7);
-	strncat(osp_share2_pkgid_path, pkgid, strlen(pkgid));
+	strncat(osp_share2_pkgid_path, pkgid, MAX_PACKAGE_ID);
 
-	strncpy(mount_info[0].src_path, osp_share_pkgid_path, strlen(osp_share_pkgid_path));
-	strncpy(mount_info[1].src_path, osp_share2_pkgid_path, strlen(osp_share2_pkgid_path));
+	strncpy(mount_info[0].src_path, osp_share_pkgid_path, PATH_MAX - 1);
+	strncpy(mount_info[1].src_path, osp_share2_pkgid_path, PATH_MAX - 1);
 
 	if (chdir(app_rootpath) != 0)
 	{
@@ -406,27 +416,27 @@ create_osp_external_paths(const char* app_rootpath, const char* pkgid)
 
 	strncpy(osp_ext_apps_pkgid_path, _EXT_OSP_HOME_PATH, strlen(_EXT_OSP_HOME_PATH));
 	strncat(osp_ext_apps_pkgid_path, "apps/", 5);
-	strncat(osp_ext_apps_pkgid_path, pkgid, strlen(pkgid));
+	strncat(osp_ext_apps_pkgid_path, pkgid, MAX_PACKAGE_ID);
 
-	strncpy(osp_ext_apps_pkgid_share_path, osp_ext_apps_pkgid_path, strlen(osp_ext_apps_pkgid_path));
+	strncpy(osp_ext_apps_pkgid_share_path, osp_ext_apps_pkgid_path, PATH_MAX - 1);
 	strncat(osp_ext_apps_pkgid_share_path, "/Share", 6);
 
-	strncpy(osp_ext_apps_pkgid_share2_path, osp_ext_apps_pkgid_path, strlen(osp_ext_apps_pkgid_path));
+	strncpy(osp_ext_apps_pkgid_share2_path, osp_ext_apps_pkgid_path, PATH_MAX - 1);
 	strncat(osp_ext_apps_pkgid_share2_path, "/Share2", 7);
 
 	strncpy(osp_ext_share_pkgid_path, _EXT_OSP_HOME_PATH, strlen(_EXT_OSP_HOME_PATH));
 	strncat(osp_ext_share_pkgid_path, "share/", 6);
-	strncat(osp_ext_share_pkgid_path, pkgid, strlen(pkgid));
+	strncat(osp_ext_share_pkgid_path, pkgid, MAX_PACKAGE_ID);
 
 	strncpy(osp_ext_share2_pkgid_path, _EXT_OSP_HOME_PATH, strlen(_EXT_OSP_HOME_PATH));
 	strncat(osp_ext_share2_pkgid_path, "share2/", 7);
-	strncat(osp_ext_share2_pkgid_path, pkgid, strlen(pkgid));
+	strncat(osp_ext_share2_pkgid_path, pkgid, MAX_PACKAGE_ID);
 
-	strncpy(external_dirs[7].path, osp_ext_apps_pkgid_path, strlen(osp_ext_apps_pkgid_path));
-	strncpy(external_dirs[8].path, osp_ext_apps_pkgid_share_path, strlen(osp_ext_apps_pkgid_share_path));
-	strncpy(external_dirs[9].path, osp_ext_apps_pkgid_share2_path, strlen(osp_ext_apps_pkgid_share2_path));
-	strncpy(external_dirs[10].path, osp_ext_share_pkgid_path, strlen(osp_ext_share_pkgid_path));
-	strncpy(external_dirs[11].path, osp_ext_share2_pkgid_path, strlen(osp_ext_share2_pkgid_path));
+	strncpy(external_dirs[7].path, osp_ext_apps_pkgid_path, PATH_MAX - 1);
+	strncpy(external_dirs[8].path, osp_ext_apps_pkgid_share_path, PATH_MAX - 1);
+	strncpy(external_dirs[9].path, osp_ext_apps_pkgid_share2_path, PATH_MAX - 1);
+	strncpy(external_dirs[10].path, osp_ext_share_pkgid_path, PATH_MAX - 1);
+	strncpy(external_dirs[11].path, osp_ext_share2_pkgid_path, PATH_MAX - 1);
 
 	if (chdir(app_rootpath) != 0)
 	{
@@ -466,19 +476,19 @@ mount_osp_external_paths(const char* app_rootpath, const char* pkgid)
 
 	strncpy(osp_ext_apps_pkgid_path, _EXT_OSP_HOME_PATH, strlen(_EXT_OSP_HOME_PATH));
 	strncat(osp_ext_apps_pkgid_path, "apps/", 5);
-	strncat(osp_ext_apps_pkgid_path, pkgid, strlen(pkgid));
+	strncat(osp_ext_apps_pkgid_path, pkgid, MAX_PACKAGE_ID);
 
 	strncpy(osp_ext_share_pkgid_path, _EXT_OSP_HOME_PATH, strlen(_EXT_OSP_HOME_PATH));
 	strncat(osp_ext_share_pkgid_path, "share/", 6);
-	strncat(osp_ext_share_pkgid_path, pkgid, strlen(pkgid));
+	strncat(osp_ext_share_pkgid_path, pkgid, MAX_PACKAGE_ID);
 
 	strncpy(osp_ext_share2_pkgid_path, _EXT_OSP_HOME_PATH, strlen(_EXT_OSP_HOME_PATH));
 	strncat(osp_ext_share2_pkgid_path, "share2/", 7);
-	strncat(osp_ext_share2_pkgid_path, pkgid, strlen(pkgid));
+	strncat(osp_ext_share2_pkgid_path, pkgid, MAX_PACKAGE_ID);
 
-	strncpy(mount_info[3].src_path, osp_ext_apps_pkgid_path, strlen(osp_ext_apps_pkgid_path));
-	strncpy(mount_info[4].src_path, osp_ext_share_pkgid_path, strlen(osp_ext_share_pkgid_path));
-	strncpy(mount_info[5].src_path, osp_ext_share2_pkgid_path, strlen(osp_ext_share2_pkgid_path));
+	strncpy(mount_info[3].src_path, osp_ext_apps_pkgid_path, PATH_MAX - 1);
+	strncpy(mount_info[4].src_path, osp_ext_share_pkgid_path, PATH_MAX - 1);
+	strncpy(mount_info[5].src_path, osp_ext_share2_pkgid_path, PATH_MAX - 1);
 
 	if (chdir(app_rootpath) != 0)
 	{
@@ -636,31 +646,30 @@ ERROR:
 }
 
 int
-do_pre_exec(const char* package_name, const char* bin_path)
+do_pre_exec(const char* app_id, const char* bin_path)
 {
 	char* app_rootpath = NULL;
 	char app_compat_path[PATH_MAX] = { 0, };
-	const char app_compat_file[] = "/info/compat.info\0";
-	char osp_app_data_path[PATH_MAX] = { 0, };
+	const char app_compat_file[] = "/info/compat.info";
+	char app_data_path[PATH_MAX] = { 0, };
 	int osp_compat = 0;
 
-	_SECURE_LOGI("do_pre_exec() is called, app name: %s, binary path: %s", package_name, bin_path);
-
 	app_rootpath = get_app_rootpath_from_path(bin_path);
 
-	strncpy(app_compat_path, app_rootpath, strlen(app_rootpath));
+	strncpy(app_compat_path, app_rootpath, PATH_MAX - 1);
 	strncat(app_compat_path, app_compat_file, strlen(app_compat_file));
 	if (access(app_compat_path, F_OK) == 0)
 	{
 		osp_compat = 1;
 	}
 
-	appinfo_init(package_name, 0);
+	appinfo_init(app_id, 0);
 	appinfo_set_compat(osp_compat);
 
 	const char* package_id = appinfo_get_packageid();
 
-	_SECURE_LOGI("package id: %s, binary path: %s, OSP compat: %d", package_id, bin_path, osp_compat);
+	_SECURE_LOGI("do_pre_exec() is called, bin path: %s, app root: %s, app id: %s, pkg id: %s, osp-compatible: %d",
+			bin_path, app_rootpath, app_id, package_id, osp_compat);
 
 	// FIXME: Temporary code with security risk
 	prctl(PR_SET_KEEPCAPS, 1);
@@ -674,7 +683,7 @@ do_pre_exec(const char* package_name, const char* bin_path)
 
 	char virtual_root_file[PATH_MAX] = { 0, };
 	const char virtual_root_info[] = "/info/virtualroot.info";
-	strncpy(virtual_root_file, app_rootpath, strlen(app_rootpath));
+	strncpy(virtual_root_file, app_rootpath, PATH_MAX - 1);
 	strncat(virtual_root_file, virtual_root_info, strlen(virtual_root_info));
 	if (access(virtual_root_file, F_OK) == 0)
 	{
@@ -706,12 +715,12 @@ do_pre_exec(const char* package_name, const char* bin_path)
 
 	// API version is equal to or greater than Tizen 2.0
 	// Set current working dir to "/opt/apps/{pkgId}/data"
-	strncpy(osp_app_data_path, app_rootpath, strlen(app_rootpath));
-	strncat(osp_app_data_path, "/data", strlen("/data"));
+	strncpy(app_data_path, app_rootpath, PATH_MAX - 1);
+	strncat(app_data_path, "/data", strlen("/data"));
 
-	if (chdir(osp_app_data_path) != 0)
+	if (chdir(app_data_path) != 0)
 	{
-		LOGE("chdir() failed, path: %s, errno: %d (%s)", osp_app_data_path, errno, strerror(errno));
+		LOGE("chdir() failed, path: %s, errno: %d (%s)", app_data_path, errno, strerror(errno));
 		goto ERROR;
 	}