Browse Source

[uri] Avoid potentially large stack allocation

Avoid potentially large stack allocation in resolve_path().

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 8 years ago
parent
commit
295ad11367
1 changed files with 12 additions and 9 deletions
  1. 12
    9
      src/core/uri.c

+ 12
- 9
src/core/uri.c View File

606
  *
606
  *
607
  * @v base_uri		Base path
607
  * @v base_uri		Base path
608
  * @v relative_uri	Relative path
608
  * @v relative_uri	Relative path
609
- * @ret resolved_uri	Resolved path
609
+ * @ret resolved_uri	Resolved path, or NULL on failure
610
  *
610
  *
611
  * Takes a base path (e.g. "/var/lib/tftpboot/vmlinuz" and a relative
611
  * Takes a base path (e.g. "/var/lib/tftpboot/vmlinuz" and a relative
612
  * path (e.g. "initrd.gz") and produces a new path
612
  * path (e.g. "initrd.gz") and produces a new path
617
  */
617
  */
618
 char * resolve_path ( const char *base_path,
618
 char * resolve_path ( const char *base_path,
619
 		      const char *relative_path ) {
619
 		      const char *relative_path ) {
620
-	size_t base_len = ( strlen ( base_path ) + 1 );
621
-	char base_path_copy[base_len];
622
-	char *base_tmp = base_path_copy;
620
+	char *base_copy;
621
+	char *base_tmp;
623
 	char *resolved;
622
 	char *resolved;
624
 
623
 
625
 	/* If relative path is absolute, just re-use it */
624
 	/* If relative path is absolute, just re-use it */
627
 		return strdup ( relative_path );
626
 		return strdup ( relative_path );
628
 
627
 
629
 	/* Create modifiable copy of path for dirname() */
628
 	/* Create modifiable copy of path for dirname() */
630
-	memcpy ( base_tmp, base_path, base_len );
631
-	base_tmp = dirname ( base_tmp );
629
+	base_copy = strdup ( base_path );
630
+	if ( ! base_copy )
631
+		return NULL;
632
+
633
+	/* Strip filename portion of base path */
634
+	base_tmp = dirname ( base_copy );
632
 
635
 
633
 	/* Process "./" and "../" elements */
636
 	/* Process "./" and "../" elements */
634
 	while ( *relative_path == '.' ) {
637
 	while ( *relative_path == '.' ) {
658
 	if ( asprintf ( &resolved, "%s%s%s", base_tmp,
661
 	if ( asprintf ( &resolved, "%s%s%s", base_tmp,
659
 			( ( base_tmp[ strlen ( base_tmp ) - 1 ] == '/' ) ?
662
 			( ( base_tmp[ strlen ( base_tmp ) - 1 ] == '/' ) ?
660
 			  "" : "/" ), relative_path ) < 0 )
663
 			  "" : "/" ), relative_path ) < 0 )
661
-		return NULL;
662
-
664
+		resolved = NULL;
665
+	free ( base_copy );
663
 	return resolved;
666
 	return resolved;
664
 }
667
 }
665
 
668
 
668
  *
671
  *
669
  * @v base_uri		Base URI, or NULL
672
  * @v base_uri		Base URI, or NULL
670
  * @v relative_uri	Relative URI
673
  * @v relative_uri	Relative URI
671
- * @ret resolved_uri	Resolved URI
674
+ * @ret resolved_uri	Resolved URI, or NULL on failure
672
  *
675
  *
673
  * Takes a base URI (e.g. "http://ipxe.org/kernels/vmlinuz" and a
676
  * Takes a base URI (e.g. "http://ipxe.org/kernels/vmlinuz" and a
674
  * relative URI (e.g. "../initrds/initrd.gz") and produces a new URI
677
  * relative URI (e.g. "../initrds/initrd.gz") and produces a new URI

Loading…
Cancel
Save