135135typedef enum { AVC_UNSET , AVC_DENIED , AVC_GRANTED } avc_t ;
136136typedef enum { S_UNSET = -1 , S_FAILED , S_SUCCESS } success_t ;
137137
138- static char * print_escaped (char * val );
138+ static char * print_escaped (const char * val );
139139static const char * print_signals (const char * val , unsigned int base );
140140
141141/*
@@ -336,10 +336,11 @@ static int is_hex_string(const char *str)
336336}
337337
338338/* returns a freshly malloc'ed and converted buffer */
339- char * au_unescape (char * buf )
339+ char * au_unescape (const char * buf )
340340{
341341 int olen , len , i ;
342- char saved , * str , * ptr = buf ;
342+ char * str , * work ;
343+ const char * ptr = buf ;
343344
344345 /* Find the end of the name */
345346 if (* ptr == '(' ) {
@@ -362,10 +363,8 @@ char *au_unescape(char *buf)
362363 if (!str )
363364 return NULL ;
364365
365- saved = * ptr ;
366- * ptr = 0 ;
367- strcpy (str , buf );
368- * ptr = saved ;
366+ memcpy (str , buf , ptr - buf );
367+ str [ptr - buf ] = 0 ;
369368
370369 /* See if its '(null)' from the kernel */
371370 if (* buf == '(' )
@@ -379,17 +378,17 @@ char *au_unescape(char *buf)
379378 free (str );
380379 return NULL ;
381380 }
382- ptr = str ;
381+ work = str ;
383382 for (i = 0 ; i < len ; i += 2 ) {
384- * ptr = x2c ((unsigned char * )& str [i ]);
385- ptr ++ ;
383+ * work = x2c ((unsigned char * )& str [i ]);
384+ work ++ ;
386385 }
387- * ptr = 0 ;
388- len = ptr - str - 1 ;
386+ * work = 0 ;
387+ len = work - str - 1 ;
389388 olen /= 2 ;
390389 // Because *ptr is 0, writing another 0 to it doesn't hurt anything
391390 if (olen > len )
392- memset (ptr , 0 , olen - len );
391+ memset (work , 0 , olen - len );
393392 return str ;
394393}
395394
@@ -904,23 +903,20 @@ static const char *print_exit(const char *val)
904903 return strdup (val );
905904}
906905
907- static char * print_escaped (char * val )
906+ static char * print_escaped (const char * val )
908907{
909908 char * out ;
910909
911910 if (val == NULL )
912911 return strdup (" " );
913912
914913 if (* val == '"' ) {
915- char * term ;
914+ const char * term ;
916915 val ++ ;
917916 term = strchr (val , '"' );
918917 if (term == NULL )
919918 return strdup (" " );
920- * term = 0 ;
921- out = strdup (val );
922- * term = '"' ;
923- return out ;
919+ return strndup (val , term - val );
924920// FIXME: working here...was trying to detect (null) and handle that
925921// differently. The other 2 should have " around the file names.
926922/* } else if (*val == '(') {
@@ -932,9 +928,9 @@ static char *print_escaped(char *val)
932928 *term = 0;
933929 printf("%s ", val); */
934930 } else if (val [0 ] == '0' && val [1 ] == '0' )
935- out = au_unescape (( char * ) & val [2 ]); // Abstract name af_unix
931+ out = au_unescape (& val [2 ]); // Abstract name af_unix
936932 else
937- out = au_unescape (( char * ) val );
933+ out = au_unescape (val );
938934 if (out )
939935 return out ;
940936 return strdup (val ); // Something is wrong with string, just send as is
@@ -1295,7 +1291,7 @@ static const char *print_sockaddr(const char *val)
12951291 const char * str ;
12961292
12971293 slen = strlen (val )/2 ;
1298- host = au_unescape (( char * ) val );
1294+ host = au_unescape (val );
12991295 if (host == NULL ) {
13001296 if (asprintf (& out , "malformed-host(%s)" , val ) < 0 )
13011297 out = NULL ;
@@ -3205,7 +3201,7 @@ static const char *print_tty_data(const char *raw_data)
32053201
32063202 if (!is_hex_string (raw_data ))
32073203 return strdup (raw_data );
3208- data = au_unescape (( char * ) raw_data );
3204+ data = au_unescape (raw_data );
32093205 if (data == NULL )
32103206 return NULL ;
32113207 data_end = data + strlen (raw_data ) / 2 ;
@@ -3580,7 +3576,7 @@ char *auparse_do_interpretation(auparse_state_t *au, int type, const idata *id,
35803576 }
35813577
35823578 if (escape_mode != AUPARSE_ESC_RAW && out ) {
3583- char * str = NULL ;
3579+ const char * str = NULL ;
35843580 unsigned int len = strlen (out );
35853581 if (type == AUPARSE_TYPE_ESCAPED_KEY ) {
35863582 // The audit key separator causes a false
@@ -3601,24 +3597,32 @@ char *auparse_do_interpretation(auparse_state_t *au, int type, const idata *id,
36013597 } else {
36023598 // We have multiple keys. Need to look at each one.
36033599 unsigned int cnt = 0 ;
3604- char * ptr = (char * )out ;
3600+ char * mutable , * ptr , * sep ;
3601+
3602+ mutable = strdup (out );
3603+ if (mutable == NULL )
3604+ return (char * )out ;
3605+ ptr = mutable ;
3606+ sep = strchr (ptr , AUDIT_KEY_SEPARATOR );
3607+ if (sep == NULL )
3608+ sep = strchr (ptr , 0 );
36053609
36063610 while (* ptr ) {
3607- unsigned int klen = str - ptr ;
3608- char tmp = * str ;
3609- * str = 0 ;
3611+ unsigned int klen = sep - ptr ;
3612+ char tmp = * sep ;
3613+ * sep = 0 ;
36103614 cnt += need_escaping (ptr , klen ,
36113615 escape_mode );
3612- * str = tmp ;
3613- ptr = str ;
3616+ * sep = tmp ;
3617+ ptr = sep ;
36143618 // If we are not at the end...
36153619 if (tmp ) {
36163620 ptr ++ ;
3617- str = strchr (ptr , AUDIT_KEY_SEPARATOR );
3621+ sep = strchr (ptr , AUDIT_KEY_SEPARATOR );
36183622 // If we don't have anymore, just
36193623 // point to the end
3620- if (str == NULL )
3621- str = strchr (ptr , 0 );
3624+ if (sep == NULL )
3625+ sep = strchr (ptr , 0 );
36223626 }
36233627 }
36243628 if (cnt ) {
@@ -3632,22 +3636,24 @@ char *auparse_do_interpretation(auparse_state_t *au, int type, const idata *id,
36323636 // incase there's a Ctl-A in the key.
36333637 // This is likely fuzzer induced.
36343638 char tmp ;
3635- str = strchr (out , AUDIT_KEY_SEPARATOR );
3636- if (str ) {
3637- tmp = * str ;
3638- * str = 0 ;
3639- key_escape (out , dest ,
3639+ sep = strchr (mutable ,
3640+ AUDIT_KEY_SEPARATOR );
3641+ if (sep ) {
3642+ tmp = * sep ;
3643+ * sep = 0 ;
3644+ key_escape (mutable , dest ,
36403645 escape_mode );
3641- * str = tmp ;
3646+ * sep = tmp ;
36423647 } else
3643- key_escape (out , dest ,
3648+ key_escape (mutable , dest ,
36443649 escape_mode );
36453650 }
3651+ free (mutable );
36463652 free ((void * )out );
36473653 out = dest ;
3648- }
3654+ } else
3655+ free (mutable );
36493656 }
36503657 }
36513658 return (char * )out ;
36523659}
3653-
0 commit comments