From 529c79dcfb0dc20c123865d1caf1142b085080d5 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>

Date: Wed, 15 Feb 2017 15:05:35 +0100

Subject: [PATCH] Fix parsing wmfrog arguments

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

A command like "wmfrog -s KSEA -o 7 -tmp /home/stela010/tmp/wmfrog"

crashed because the -tmp argument was bigger than a static buffer used

for storing the argument value. There were similar issues with other

argument values.

This patch fixes it. It also fixes the fact that -tmp argument was

always ignored and user's home directory was used instead.

<https://bugzilla.redhat.com/show_bug.cgi?id=1422319>

Signed-off-by: Petr Písař <ppisar@redhat.com>

---

 Src/wmFrog.c | 66 +++++++++++++++++++++++++++++++++++++++++++++++++-----------

 1 file changed, 54 insertions(+), 12 deletions(-)

diff --git a/Src/wmFrog.c b/Src/wmFrog.c

index 24f795c..c422e55 100644

--- a/Src/wmFrog.c

+++ b/Src/wmFrog.c

@@ -12,6 +12,7 @@

 /*

  *   Includes

  */

+#define _XOPEN_SOURCE 500 /* For strdup(3) */

 #include <signal.h>

 #include <stdio.h>

 #include <math.h>

@@ -74,7 +75,7 @@ int NeedsUpdate = 1;

 int maxWind = MAX_WIND;

 int timeOffset = TIME_OFFSET;

 long UpdateDelay;

-char* folder;

+char* folder = NULL;

 int needsUpdate = 1;

 /*

@@ -91,7 +92,9 @@ int main(int argc, char *argv[]) {

      */

     ParseCMDLine(argc, argv);

-    folder = GetTempDir(".wmapps");

+    if (NULL == folder) {

+        folder = GetTempDir(".wmapps");

+    }

     initXwindow(argc, argv);

@@ -343,7 +346,11 @@ void ParseCMDLine(int argc, char *argv[]) {

                 print_usage();

                 exit(-1);

             }

-            strcpy(folder, argv[++i]);

+            folder = strdup(argv[++i]);

+            if (NULL == folder) {

+                fprintf(stderr, "Not enough memory to copy -tmp argument.\n");

+                exit(-1);

+            }

         } else if ((!strcmp(argv[i], "-station")) || (!strcmp(argv[i], "-s"))) {

@@ -352,6 +359,10 @@ void ParseCMDLine(int argc, char *argv[]) {

                 print_usage();

                 exit(-1);

             }

+            if (strlen(argv[i + 1]) >= sizeof(StationID)/sizeof(*StationID) - 1) {

+                fprintf(stderr, "METAR station ID is too long.\n");

+                exit(-1);

+            }

             strcpy(StationID, StringToUpper(argv[++i]));

             strcpy(Label, StationID);

         } else if (!strcmp(argv[i], "-delay")) {

@@ -377,6 +388,10 @@ void ParseCMDLine(int argc, char *argv[]) {

                 print_usage();

                 exit(-1);

             }

+            if (strlen(argv[i + 1]) >= sizeof(Label)/sizeof(*Label) - 1) {

+                fprintf(stderr, "Station label is too long.\n");

+                exit(-1);

+            }

             strcpy(Label, StringToUpper(argv[++i]));

         }

     }

@@ -454,7 +469,8 @@ double UT;

 // Will be called at regular interval to update the weather data (alarm)

 void UpdateData() {

-    char command[1024], Line[512], FileName[128];

+    char *command, Line[512], *FileName;

+    const char weatherPlScript[] = "/usr/lib/wmfrog/weather.pl";

     int ign;

     char* igns;

     igns = (char*) malloc(512);

@@ -492,13 +508,29 @@ void UpdateData() {

     /*

      *  Execute Perl script to grab the Latest METAR Report

      */

-    snprintf(command, 1024, "/usr/lib/wmfrog/weather.pl %s %s", StationID, folder);

-    //printf("Retrieveing data\n");

-    ign = system(command);

-    snprintf(FileName, 128, "%s/%s", folder, StationID);

-    //fprintf(stderr,"%s\n\n",FileName);

+    command = malloc(strlen(weatherPlScript) + 1 + strlen(StationID) + 1

+            + strlen(folder) + 1);

+    if (NULL == command) {

+        fprintf(stderr, "Not enough memory to build wheater.pl command.\n");

+    } else {

+        sprintf(command, "%s %s %s", weatherPlScript, StationID, folder);

+        //printf("Retrieveing data\n");

+        ign = system(command);

+        free(command);

+    }

+

+    FileName = malloc(strlen(folder) + 1 + strlen(StationID) + 1);

+    if (NULL == FileName) {

+        fprintf(stderr, "Not enough memory to build staion ID file name.\n");

+        fp = NULL;

+    } else {

+        sprintf(FileName, "%s/%s", folder, StationID);

+        //fprintf(stderr,"%s\n\n",FileName);

+        fp = fopen(FileName, "r");

+        free(FileName);

+    }

-    if ((fp = fopen(FileName, "r")) != NULL) {

+    if (fp != NULL) {

         ign = fscanf(fp, "Hour:%d", &weather.hour);

         igns = fgets(Line, 512, fp); //h

         ign = fscanf(fp, "Minute:%d", &weather.min);

@@ -620,11 +652,21 @@ void UpdateData() {

 char *GetTempDir(char *suffix) {

     uid_t id;

     struct passwd *userEntry;

-    static char userHome[128];

+    char *userHome;

     id = getuid();

     userEntry = getpwuid(id);

-    snprintf(userHome, 128, "%s/%s", userEntry->pw_dir, suffix);

+    if (NULL == userEntry) {

+        perror("Could not retrieve user's passwd entry");

+        exit(-1);

+    }

+

+    userHome = malloc(strlen(userEntry->pw_dir) + 1 + strlen(suffix) + 1);

+    if (NULL == userHome) {

+        fprintf(stderr, "Not enough memory for building temporary path.\n");

+        exit(-1);

+    }

+    sprintf(userHome, "%s/%s", userEntry->pw_dir, suffix);

     return userHome;

 }

-- 

2.7.4