diff options
author | Nick Kralevich <nnk@google.com> | 2013-09-16 10:31:12 -0700 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2013-09-16 10:31:12 -0700 |
commit | b453a9aa1d6f0b2ac624583938202983ad25673b (patch) | |
tree | 6acd30c909015e9ce255dc3584e1b3bc42671ea2 /init | |
parent | 5c0e6410d04c60fba043a68ffc9ae58c302a32bd (diff) | |
parent | 3a0d4b34816d65e21951f44e4d98a954c5c855ae (diff) | |
download | system_core-b453a9aa1d6f0b2ac624583938202983ad25673b.zip system_core-b453a9aa1d6f0b2ac624583938202983ad25673b.tar.gz system_core-b453a9aa1d6f0b2ac624583938202983ad25673b.tar.bz2 |
am 3a0d4b34: Merge "property_service: better validate property names" into klp-dev
* commit '3a0d4b34816d65e21951f44e4d98a954c5c855ae':
property_service: better validate property names
Diffstat (limited to 'init')
-rw-r--r-- | init/property_service.c | 41 |
1 files changed, 37 insertions, 4 deletions
diff --git a/init/property_service.c b/init/property_service.c index 5e7fe89..c370769 100644 --- a/init/property_service.c +++ b/init/property_service.c @@ -278,6 +278,34 @@ static void write_persistent_property(const char *name, const char *value) } } +static bool is_legal_property_name(const char* name, size_t namelen) +{ + size_t i; + bool previous_was_dot = false; + if (namelen >= PROP_NAME_MAX) return false; + if (namelen < 1) return false; + if (name[0] == '.') return false; + if (name[namelen - 1] == '.') return false; + + /* Only allow alphanumeric, plus '.', '-', or '_' */ + /* Don't allow ".." to appear in a property name */ + for (i = 0; i < namelen; i++) { + if (name[i] == '.') { + if (previous_was_dot == true) return false; + previous_was_dot = true; + continue; + } + previous_was_dot = false; + if (name[i] == '_' || name[i] == '-') continue; + if (name[i] >= 'a' && name[i] <= 'z') continue; + if (name[i] >= 'A' && name[i] <= 'Z') continue; + if (name[i] >= '0' && name[i] <= '9') continue; + return false; + } + + return true; +} + int property_set(const char *name, const char *value) { prop_info *pi; @@ -286,9 +314,8 @@ int property_set(const char *name, const char *value) size_t namelen = strlen(name); size_t valuelen = strlen(value); - if(namelen >= PROP_NAME_MAX) return -1; - if(valuelen >= PROP_VALUE_MAX) return -1; - if(namelen < 1) return -1; + if (!is_legal_property_name(name, namelen)) return -1; + if (valuelen >= PROP_VALUE_MAX) return -1; pi = (prop_info*) __system_property_find(name); @@ -300,7 +327,7 @@ int property_set(const char *name, const char *value) } else { ret = __system_property_add(name, namelen, value, valuelen); if (ret < 0) { - ERROR("Failed to set '%s'='%s'", name, value); + ERROR("Failed to set '%s'='%s'\n", name, value); return ret; } } @@ -366,6 +393,12 @@ void handle_property_set_fd() msg.name[PROP_NAME_MAX-1] = 0; msg.value[PROP_VALUE_MAX-1] = 0; + if (!is_legal_property_name(msg.name, strlen(msg.name))) { + ERROR("sys_prop: illegal property name. Got: \"%s\"\n", msg.name); + close(s); + return; + } + getpeercon(s, &source_ctx); if(memcmp(msg.name,"ctl.",4) == 0) { |