[igt-dev] [PATCH i-g-t v3] tests/testdisplay: fix heap overflow

[Simon Ser]

v2: also simplify the code by using dirname(3).

v3: dirname may modify in-place its argument, duplicate the string

Signed-off-by: Simon Ser <simon.ser at intel.com>
---

We can't free() the return value of dirname(), because it might be
statically allocated.

Also, we don't want to chdir(NULL).

 tests/testdisplay.c | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/tests/testdisplay.c b/tests/testdisplay.c
index b3657264..67d1b68a 100644
--- a/tests/testdisplay.c
+++ b/tests/testdisplay.c
@@ -51,6 +51,7 @@
 #include <cairo.h>
 #include <errno.h>
 #include <getopt.h>
+#include <libgen.h>
 #include <math.h>
 #include <stdint.h>
 #include <stdbool.h>
@@ -563,24 +564,17 @@ static gboolean input_event(GIOChannel *source, GIOCondition condition,
 	return TRUE;
 }
 
-static void enter_exec_path( char **argv )
+static void enter_exec_path(const char **argv)
 {
-	char *exec_path = NULL;
-	char *pos = NULL;
-	short len_path = 0;
+	char *argv0, *exec_path;
 	int ret;
 
-	len_path = strlen( argv[0] );
-	exec_path = (char*) malloc(len_path);
-
-	memcpy(exec_path, argv[0], len_path);
-	pos = strrchr(exec_path, '/');
-	if (pos != NULL)
-		*(pos+1) = '\0';
-
+	argv0 = strdup(argv[0]);
+	igt_assert(argv0);
+	exec_path = dirname(argv0);
 	ret = chdir(exec_path);
 	igt_assert_eq(ret, 0);
-	free(exec_path);
+	free(argv0);
 }
 
 static void restore_termio_mode(int sig)
@@ -626,7 +620,7 @@ int main(int argc, char **argv)
 
 	igt_skip_on_simulation();
 
-	enter_exec_path( argv );
+	enter_exec_path((const char **) argv);
 
 	while ((c = getopt_long(argc, argv, optstr, long_opts, NULL)) != -1) {
 		switch (c) {
-- 
2.21.0

---------------------------------------------------------------------
Intel Finland Oy
Registered Address: PL 281, 00181 Helsinki 
Business Identity Code: 0357606 - 4 
Domiciled in Helsinki 

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.