file: uci_parse_package: fix heap use after free

[project/uci.git] / file.c

diff --git a/file.c b/file.c
index 76f7f322afbd4e9575d75fd0774643a184c637d9..23bf49a16f631070b55a0909c733a167b432dfb4 100644 (file)
--- a/file.c
+++ b/file.c
@@ -28,6 +28,7 @@
 #include <glob.h>
 #include <string.h>
 #include <stdlib.h>
+#include <errno.h>
 
 #include "uci.h"
 #include "uci_internal.h"
@@ -70,8 +71,6 @@ __private void uci_getln(struct uci_context *ctx, int offset)
 
                pctx->bufsz *= 2;
                pctx->buf = uci_realloc(ctx, pctx->buf, pctx->bufsz);
-               if (!pctx->buf)
-                       UCI_THROW(ctx, UCI_ERR_MEM);
        } while (1);
 }
 
@@ -288,27 +287,6 @@ int uci_parse_argument(struct uci_context *ctx, FILE *stream, char **str, char *
        return 0;
 }
 
-/*
- * Fixup sections functions does the fixup of all sections for given package.
- * It is used as a preprocessing step for fixing up existing anonymous sections
- * from configurations.
- *
- * It uses uci_fixup_section() from list.c and then adds delta changes.
- */
-static void
-uci_fixup_sections(struct uci_context *ctx, struct uci_package *p)
-{
-       struct uci_element *e;
-       struct uci_section *s;
-
-       uci_foreach_element(&p->sections, e) {
-               s = uci_to_section(e);
-               s->package->name_index++;
-               uci_fixup_section(ctx, s);
-               s->anonymous = false;
-       }
-}
-
 static int
 uci_fill_ptr(struct uci_context *ctx, struct uci_ptr *ptr, struct uci_element *e)
 {
@@ -410,8 +388,8 @@ static void uci_parse_package(struct uci_context *ctx, bool single)
        pctx->pos += strlen(pctx_cur_str(pctx)) + 1;
 
        ofs_name = next_arg(ctx, true, true, true);
-       name = pctx_str(pctx, ofs_name);
        assert_eol(ctx);
+       name = pctx_str(pctx, ofs_name);
        if (single)
                return;
 
@@ -447,9 +425,9 @@ static void uci_parse_config(struct uci_context *ctx)
                uci_parse_error(ctx, "invalid character in type field");
 
        ofs_name = next_arg(ctx, false, true, false);
+       assert_eol(ctx);
        type = pctx_str(pctx, ofs_type);
        name = pctx_str(pctx, ofs_name);
-       assert_eol(ctx);
 
        if (!name || !name[0]) {
                ctx->internal = !pctx->merge;
@@ -493,9 +471,9 @@ static void uci_parse_option(struct uci_context *ctx, bool list)
 
        ofs_name = next_arg(ctx, true, true, false);
        ofs_value = next_arg(ctx, false, false, false);
+       assert_eol(ctx);
        name = pctx_str(pctx, ofs_name);
        value = pctx_str(pctx, ofs_value);
-       assert_eol(ctx);
 
        uci_fill_ptr(ctx, &ptr, &pctx->section->e);
        e = uci_lookup_list(&pctx->section->options, name);
@@ -591,7 +569,7 @@ static const char *uci_escape(struct uci_context *ctx, const char *str)
                len = end - str;
 
                /* make sure that we have enough room in the buffer */
-               while (ofs + len + sizeof(UCI_QUOTE_ESCAPE) + 1 > ctx->bufsz) {
+               while (ofs + len + (int) sizeof(UCI_QUOTE_ESCAPE) + 1 > ctx->bufsz) {
                        ctx->bufsz *= 2;
                        ctx->buf = uci_realloc(ctx, ctx->buf, ctx->bufsz);
                }
@@ -626,7 +604,8 @@ static void uci_export_package(struct uci_package *p, FILE *stream, bool header)
        uci_foreach_element(&p->sections, s) {
                struct uci_section *sec = uci_to_section(s);
                fprintf(stream, "\nconfig %s", uci_escape(ctx, sec->type));
-               fprintf(stream, " '%s'", uci_escape(ctx, sec->e.name));
+               if (!sec->anonymous || (ctx->flags & UCI_FLAG_EXPORT_NAME))
+                       fprintf(stream, " '%s'", uci_escape(ctx, sec->e.name));
                fprintf(stream, "\n");
                uci_foreach_element(&sec->options, o) {
                        struct uci_option *opt = uci_to_option(o);
@@ -717,7 +696,6 @@ error:
        if (pctx->merge)
                pctx->package = NULL;
 
-       uci_fixup_sections(ctx, *package);
        pctx->name = NULL;
        uci_switch_config(ctx);
 
@@ -743,11 +721,12 @@ static void uci_file_commit(struct uci_context *ctx, struct uci_package **packag
 {
        struct uci_package *p = *package;
        FILE *f1, *f2 = NULL;
-       char *name = NULL;
-       char *path = NULL;
+       char *volatile name = NULL;
+       char *volatile path = NULL;
        char *filename = NULL;
        struct stat statbuf;
-       bool do_rename = false;
+       volatile bool do_rename = false;
+       int fd;
 
        if (!p->path) {
                if (overwrite)
@@ -793,18 +772,20 @@ static void uci_file_commit(struct uci_context *ctx, struct uci_package **packag
                        goto done;
        }
 
-       if (!mktemp(filename))
-               *filename = 0;
+       fd = mkstemp(filename);
+       if (fd == -1)
+               UCI_THROW(ctx, UCI_ERR_IO);
 
-       if (!*filename) {
-               free(filename);
+       if ((flock(fd, LOCK_EX) < 0) && (errno != ENOSYS))
+               UCI_THROW(ctx, UCI_ERR_IO);
+
+       if (lseek(fd, 0, SEEK_SET) < 0)
                UCI_THROW(ctx, UCI_ERR_IO);
-       }
 
-       if ((stat(filename, &statbuf) == 0) && ((statbuf.st_mode & S_IFMT) != S_IFREG))
+       f2 = fdopen(fd, "w+");
+       if (!f2)
                UCI_THROW(ctx, UCI_ERR_IO);
 
-       f2 = uci_open_stream(ctx, filename, p->path, SEEK_SET, true, true);
        uci_export(ctx, f2, p, false);
 
        fflush(f2);
@@ -821,7 +802,7 @@ done:
        uci_close_stream(f1);
        if (do_rename) {
                path = realpath(p->path, NULL);
-               if (!path || rename(filename, path)) {
+               if (!path || stat(path, &statbuf) || chmod(filename, statbuf.st_mode) || rename(filename, path)) {
                        unlink(filename);
                        UCI_THROW(ctx, UCI_ERR_IO);
                }
@@ -854,7 +835,8 @@ static char **uci_list_config_files(struct uci_context *ctx)
 {
        char **configs;
        glob_t globbuf;
-       int size, i;
+       int size, j, skipped;
+       size_t i;
        char *buf;
        char *dir;
 
@@ -866,18 +848,22 @@ static char **uci_list_config_files(struct uci_context *ctx)
        }
 
        size = sizeof(char *) * (globbuf.gl_pathc + 1);
+       skipped = 0;
        for(i = 0; i < globbuf.gl_pathc; i++) {
                char *p;
 
                p = get_filename(globbuf.gl_pathv[i]);
-               if (!p)
+               if (!p) {
+                       skipped++;
                        continue;
+               }
 
                size += strlen(p) + 1;
        }
 
-       configs = uci_malloc(ctx, size);
-       buf = (char *) &configs[globbuf.gl_pathc + 1];
+       configs = uci_malloc(ctx, size - skipped);
+       buf = (char *) &configs[globbuf.gl_pathc + 1 - skipped];
+       j = 0;
        for(i = 0; i < globbuf.gl_pathc; i++) {
                char *p;
 
@@ -888,7 +874,7 @@ static char **uci_list_config_files(struct uci_context *ctx)
                if (!uci_validate_package(p))
                        continue;
 
-               configs[i] = buf;
+               configs[j++] = buf;
                strcpy(buf, p);
                buf += strlen(buf) + 1;
        }
@@ -897,13 +883,13 @@ static char **uci_list_config_files(struct uci_context *ctx)
        return configs;
 }
 
-static struct uci_package *uci_file_load(struct uci_context *ctx, const char *name)
+static struct uci_package *uci_file_load(struct uci_context *ctx,
+                                        const char *volatile name)
 {
        struct uci_package *package = NULL;
        char *filename;
        bool confdir;
-       FILE *file = NULL;
-       size_t n_change;
+       FILE *volatile file = NULL;
 
        switch (name[0]) {
        case '.':
@@ -933,8 +919,7 @@ static struct uci_package *uci_file_load(struct uci_context *ctx, const char *na
        if (package) {
                package->path = filename;
                package->has_delta = confdir;
-               n_change = uci_load_delta(ctx, package, false);
-               package->name_index += n_change;
+               uci_load_delta(ctx, package, false);
        }
 
 done: