udev - safer string handling - part two

diff -Nru a/namedev.c b/namedev.c
@@ -209,7 +209,9 @@
 	return -1;
 }
 
-static void apply_format(struct udevice *udev, unsigned char *string, struct sysfs_class_device *class_dev, struct sysfs_device *sysfs_device)
+static void apply_format(struct udevice *udev, char *string, size_t maxsize,
+			 struct sysfs_class_device *class_dev,
+			 struct sysfs_device *sysfs_device)
 {
 	char temp[NAME_SIZE];
 	char temp1[NAME_SIZE];

@@ -245,19 +247,19 @@
 		case 'b':
 			if (strlen(udev->bus_id) == 0)
 				break;
-			strcat(pos, udev->bus_id);
+			strnfieldcat(pos, udev->bus_id, maxsize);
 			dbg("substitute bus_id '%s'", udev->bus_id);
 			break;
 		case 'k':
 			if (strlen(udev->kernel_name) == 0)
 				break;
-			strcat(pos, udev->kernel_name);
+			strnfieldcat(pos, udev->kernel_name, maxsize);
 			dbg("substitute kernel name '%s'", udev->kernel_name);
 			break;
 		case 'n':
 			if (strlen(udev->kernel_number) == 0)
 				break;
-			strcat(pos, udev->kernel_number);
+			strnfieldcat(pos, udev->kernel_number, maxsize);
 			dbg("substitute kernel number '%s'", udev->kernel_number);
 				break;
 		case 'm':

@@ -287,11 +289,11 @@
 					}
 				}
 				if (pos3) {
-					strcat(pos, pos3);
+					strnfieldcat(pos, pos3, maxsize);
 					dbg("substitute part of result string '%s'", pos3);
 				}
 			} else {
-				strcat(pos, udev->program_result);
+				strnfieldcat(pos, udev->program_result, maxsize);
 				dbg("substitute result string '%s'", udev->program_result);
 			}
 			break;

@@ -302,20 +304,20 @@
 					dbg("sysfa attribute '%s' not found", attr);
 					break;
 				}
-				strcpy(pos, tmpattr->value);
+				strnfieldcpy(pos, tmpattr->value, maxsize);
 				dbg("substitute sysfs value '%s'", tmpattr->value);
 			} else {
 				dbg("missing attribute");
 			}
 			break;
 		case '%':
-			strcat(pos, "%");
+			strnfieldcat(pos, "%", maxsize);
 			break;
 		default:
 			dbg("unknown substitution type '%%%c'", c);
 			break;
 		}
-		strcat(pos, tail);
+		strnfieldcat(pos, tail, maxsize);
 	}
 }
 

@@ -452,7 +454,7 @@
 				strncpy(value, buffer, len);
 				pos = value + strlen(value)-1;
 				if (pos[0] == '\n')
-				pos[0] = '\0';
+					pos[0] = '\0';
 				dbg("result is '%s'", value);
 			}
 		}

@@ -724,7 +726,8 @@
 		/* execute external program */
 		if (dev->program[0] != '\0') {
 			dbg("check " FIELD_PROGRAM);
-			apply_format(udev, dev->program, class_dev, sysfs_device);
+			apply_format(udev, dev->program, sizeof(dev->program),
+				     class_dev, sysfs_device);
 			if (execute_program(dev->program, udev->program_result, NAME_SIZE) != 0) {
 				dbg(FIELD_PROGRAM " returned nozero");
 				goto try_parent;

@@ -816,8 +819,10 @@
 
 found:
 	/* substitute placeholder */
-	apply_format(udev, udev->name, class_dev, sysfs_device);
-	apply_format(udev, udev->symlink, class_dev, sysfs_device);
+	apply_format(udev, udev->name, sizeof(udev->name),
+		     class_dev, sysfs_device);
+	apply_format(udev, udev->symlink, sizeof(udev->symlink),
+		     class_dev, sysfs_device);
 	udev->partitions = dev->partitions;
 done:
 	perm = find_perm(udev->name);

diff -Nru a/udev.h b/udev.h
@@ -64,7 +64,19 @@
 #define strfieldcat(to, from) \
 do { \
 	to[sizeof(to)-1] = '\0'; \
-	strncat(to, from, sizeof(to) - strlen(to) -1); \
+	strncat(to, from, sizeof(to) - strlen(to)-1); \
+} while (0)
+
+#define strnfieldcpy(to, from, maxsize) \
+do { \
+	to[maxsize-1] = '\0'; \
+	strncpy(to, from, maxsize-1); \
+} while (0)
+
+#define strnfieldcat(to, from, maxsize) \
+do { \
+	to[maxsize-1] = '\0'; \
+	strncat(to, from, maxsize - strlen(to)-1); \
 } while (0)
 
 extern int udev_add_device(char *path, char *subsystem, int fake);

diff -Nru a/udev_config.c b/udev_config.c
@@ -81,7 +81,7 @@
 #define set_var(_name, _var)				\
 	if (strcasecmp(variable, _name) == 0) {		\
 		dbg_parse("%s = '%s'", _name, value);	\
-		strncpy(_var, value, sizeof(_var));	\
+		strnfieldcpy(_var, value, sizeof(_var));\
 	}
 
 #define set_bool(_name, _var)				\

diff -Nru a/namedev.c b/namedev.c
@@ -405,7 +405,7 @@
 	int fds[2];
 	pid_t pid;
 	int value_set = 0;
-	char buffer[256];
+	char buffer[255];
 	char *pos;
 
 	retval = pipe(fds);

diff -Nru a/udev.c b/udev.c
@@ -43,7 +43,7 @@
 unsigned char logname[42];
 void log_message (int level, const char *format, ...)
 {
-	va_list	args;
+	va_list args;
 
 	if (!udev_log)
 		return;

@@ -67,30 +67,6 @@
 	}
 }
 
-static inline char *get_action(void)
-{
-	char *action;
-
-	action = getenv("ACTION");
-	return action;
-}
-
-static inline char *get_devpath(void)
-{
-	char *devpath;
-
-	devpath = getenv("DEVPATH");
-	return devpath;
-}
-
-static inline char *get_seqnum(void)
-{
-	char *seqnum;
-
-	seqnum = getenv("SEQNUM");
-	return seqnum;
-}
-
 static char *subsystem_blacklist[] = {
 	"net",
 	"scsi_host",

@@ -130,7 +106,7 @@
 	}
 
 	/* skip blacklisted subsystems */
-	subsystem = argv[1];
+	subsystem = get_subsystem(argv[1]);
 	if (!subsystem) {
 		dbg("no subsystem?");
 		goto exit;

@@ -200,5 +176,3 @@
 
 	return udev_hotplug(argc, argv);
 }
-
-

63 lines not on this page · raw message

diff -Nru a/udevd.c b/udevd.c
@@ -119,8 +119,8 @@
 static void udev_run(struct hotplug_msg *msg)
 {
 	pid_t pid;
-	char action[32];
-	char devpath[256];
+	char action[ACTION_SIZE];
+	char devpath[DEVPATH_SIZE];
 	char *env[] = { action, devpath, NULL };
 
 	snprintf(action, sizeof(action), "ACTION=%s", msg->action);

diff -Nru a/udevd.h b/udevd.h
@@ -35,7 +35,7 @@
 	pid_t pid;
 	int seqnum;
 	time_t queue_time;
-	char action[8];
-	char devpath[128];
-	char subsystem[16];
+	char action[ACTION_SIZE];
+	char devpath[DEVPATH_SIZE];
+	char subsystem[SUBSYSTEM_SIZE];
 };

diff -Nru a/udevsend.c b/udevsend.c
@@ -52,30 +52,6 @@
 }
 #endif
 
-static inline char *get_action(void)
-{
-	char *action;
-
-	action = getenv("ACTION");
-	return action;
-}
-
-static inline char *get_devpath(void)
-{
-	char *devpath;
-
-	devpath = getenv("DEVPATH");
-	return devpath;
-}
-
-static inline char *get_seqnum(void)
-{
-	char *seqnum;
-
-	seqnum = getenv("SEQNUM");
-	return seqnum;
-}
-
 static int build_hotplugmsg(struct hotplug_msg *msg, char *action,
 			    char *devpath, char *subsystem, int seqnum)
 {

@@ -144,7 +120,7 @@
 #endif
 	dbg("version %s", UDEV_VERSION);
 
-	subsystem = argv[1];
+	subsystem = get_subsystem(argv[1]);
 	if (subsystem == NULL) {
 		dbg("no subsystem");
 		goto exit;

diff -Nru a/udevtest.c b/udevtest.c
@@ -66,30 +66,6 @@
 	}
 }
 
-static inline char *get_action(void)
-{
-	char *action;
-
-	action = getenv("ACTION");
-	return action;
-}
-
-static inline char *get_devpath(void)
-{
-	char *devpath;
-
-	devpath = getenv("DEVPATH");
-	return devpath;
-}
-
-static inline char *get_seqnum(void)
-{
-	char *seqnum;
-
-	seqnum = getenv("SEQNUM");
-	return seqnum;
-}
-
 static char *subsystem_blacklist[] = {
 	"net",
 	"scsi_host",

diff -Nru a/logging.h b/logging.h
@@ -37,14 +37,14 @@
 #undef info
 #define info(format, arg...)								\
 	do {										\
-		log_message (LOG_INFO , format , ## arg);				\
+		log_message(LOG_INFO , format , ## arg);				\
 	} while (0)
 
 #ifdef DEBUG
 #undef dbg
 #define dbg(format, arg...)								\
 	do {										\
-		log_message (LOG_DEBUG , "%s: " format , __FUNCTION__ , ## arg);	\
+		log_message(LOG_DEBUG , "%s: " format , __FUNCTION__ , ## arg);	\
 	} while (0)
 #endif
 

@@ -53,11 +53,11 @@
 #undef dbg_parse
 #define dbg_parse(format, arg...)							\
 	do {										\
-		log_message (LOG_DEBUG , "%s: " format , __FUNCTION__ , ## arg);	\
+		log_message(LOG_DEBUG , "%s: " format , __FUNCTION__ , ## arg);	\
 	} while (0)
 #endif
 
-extern void log_message (int level, const char *format, ...)
+extern void log_message(int level, const char *format, ...)
 	__attribute__ ((format (printf, 2, 3)));
 
 /* each program that uses syslog must declare this variable somewhere */

diff -Nru a/namedev.c b/namedev.c
@@ -228,7 +228,7 @@
 	pos = string;
 
 	while (1) {
-		pos = strchr(pos, '%');
+		pos = strchr(string, '%');
 		if (pos != NULL) {
 			pos[0] = '\0';
 			tail = pos+1;

@@ -247,19 +247,19 @@
 		case 'b':
 			if (strlen(udev->bus_id) == 0)
 				break;
-			strnfieldcat(pos, udev->bus_id, maxsize);
+			strnfieldcat(string, udev->bus_id, maxsize);
 			dbg("substitute bus_id '%s'", udev->bus_id);
 			break;
 		case 'k':
 			if (strlen(udev->kernel_name) == 0)
 				break;
-			strnfieldcat(pos, udev->kernel_name, maxsize);
+			strnfieldcat(string, udev->kernel_name, maxsize);
 			dbg("substitute kernel name '%s'", udev->kernel_name);
 			break;
 		case 'n':
 			if (strlen(udev->kernel_number) == 0)
 				break;
-			strnfieldcat(pos, udev->kernel_number, maxsize);
+			strnfieldcat(string, udev->kernel_number, maxsize);
 			dbg("substitute kernel number '%s'", udev->kernel_number);
 				break;
 		case 'm':

@@ -289,11 +289,11 @@
 					}
 				}
 				if (pos3) {
-					strnfieldcat(pos, pos3, maxsize);
+					strnfieldcat(string, pos3, maxsize);
 					dbg("substitute part of result string '%s'", pos3);
 				}
 			} else {
-				strnfieldcat(pos, udev->program_result, maxsize);
+				strnfieldcat(string, udev->program_result, maxsize);
 				dbg("substitute result string '%s'", udev->program_result);
 			}
 			break;

@@ -304,20 +304,20 @@
 					dbg("sysfa attribute '%s' not found", attr);
 					break;
 				}
-				strnfieldcpy(pos, tmpattr->value, maxsize);
+				strnfieldcat(string, tmpattr->value, maxsize);
 				dbg("substitute sysfs value '%s'", tmpattr->value);
 			} else {
 				dbg("missing attribute");
 			}
 			break;
 		case '%':
-			strnfieldcat(pos, "%", maxsize);
+			strnfieldcat(string, "%", maxsize);
 			break;
 		default:
 			dbg("unknown substitution type '%%%c'", c);
 			break;
 		}
-		strnfieldcat(pos, tail, maxsize);
+		strnfieldcat(string, tail, maxsize);
 	}
 }
 

diff -Nru a/udev.c b/udev.c
@@ -41,7 +41,7 @@
 
 #ifdef LOG
 unsigned char logname[42];
-void log_message (int level, const char *format, ...)
+void log_message(int level, const char *format, ...)
 {
 	va_list args;
 

@@ -76,7 +76,7 @@
 	"",
 };
 
-static int udev_hotplug(int argc, char **argv)
+static int udev_hotplug(void)
 {
 	char *action;
 	char *devpath;

@@ -106,7 +106,7 @@
 	}
 
 	/* skip blacklisted subsystems */
-	subsystem = get_subsystem(argv[1]);
+	subsystem = get_subsystem(main_argv[1]);
 	if (!subsystem) {
 		dbg("no subsystem?");
 		goto exit;

@@ -123,9 +123,6 @@
 	/* connect to the system message bus */
 	sysbus_connect();
 
-	/* initialize our configuration */
-	udev_init_config();
-
 	/* initialize udev database */
 	retval = udevdb_init(UDEVDB_DEFAULT);
 	if (retval != 0) {

@@ -172,7 +169,11 @@
 	main_envp = envp;
 
 	init_logging("udev");
+
+	/* initialize our configuration */
+	udev_init_config();
+
 	dbg("version %s", UDEV_VERSION);
 
-	return udev_hotplug(argc, argv);
+	return udev_hotplug();
 }

diff -Nru a/udev.h b/udev.h
@@ -90,7 +90,7 @@
 	char *action;
 
 	action = getenv("ACTION");
-	if (strlen(action) > ACTION_SIZE)
+	if (action != NULL && strlen(action) > ACTION_SIZE)
 		action[ACTION_SIZE-1] = '\0';
 
 	return action;

@@ -101,7 +101,7 @@
 	char *devpath;
 
 	devpath = getenv("DEVPATH");
-	if (strlen(devpath) > DEVPATH_SIZE)
+	if (devpath != NULL && strlen(devpath) > DEVPATH_SIZE)
 		devpath[DEVPATH_SIZE-1] = '\0';
 
 	return devpath;

@@ -118,7 +118,7 @@
 
 static inline char *get_subsystem(char *subsystem)
 {
-	if (strlen(subsystem) > SUBSYSTEM_SIZE)
+	if (subsystem != NULL && strlen(subsystem) > SUBSYSTEM_SIZE)
 		subsystem[SUBSYSTEM_SIZE-1] = '\0';
 
 	return subsystem;