Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-25 08:48:31 -05:00
Code Issues Projects Releases Wiki Activity

browser-wpadebug: Use execv() directly instead of os_exec()

Browse Source 
This allows the URL to be passed as a single argument to the program
instead of getting split into multiple by os_exec(). This makes the
operation more robust for cases where the URL could have been received
from an external source and could potentially add extra arguments to the
command line.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2014-10-21 14:04:25 +03:00 committed by Jouni Malinen
parent 22444bb246
commit c94382259d
1 changed files with 27 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
src/utils/browser-wpadebug.c
View File

@ -65,26 +65,15 @@ static void http_req(void *ctx, struct http_request *req)
int hs20_web_browser(const char *url)
{
char cmd[2000];
int ret;
struct http_server *http;
struct in_addr addr;
struct browser_data data;
pid_t pid;
wpa_printf(MSG_INFO, "Launching wpadebug browser to %s", url);
os_memset(&data, 0, sizeof(data));
ret = os_snprintf(cmd, sizeof(cmd),
"start -a android.action.MAIN "
"-c android.intent.category.LAUNCHER "
"-n w1.fi.wpadebug/.WpaWebViewActivity "
"-e w1.fi.wpadebug.URL '%s'", url);
if (ret < 0 || (size_t) ret >= sizeof(cmd)) {
wpa_printf(MSG_ERROR, "Too long URL");
return -1;
}
if (eloop_init() < 0) {
wpa_printf(MSG_ERROR, "eloop_init failed");
return -1;
@ -97,14 +86,37 @@ int hs20_web_browser(const char *url)
return -1;
}
if (os_exec("/system/bin/am", cmd, 1) != 0) {
wpa_printf(MSG_INFO, "Failed to launch wpadebug browser");
eloop_cancel_timeout(browser_timeout, NULL, NULL);
pid = fork();
if (pid < 0) {
perror("fork");
http_server_deinit(http);
eloop_destroy();
return -1;
}
if (pid == 0) {
/* run the external command in the child process */
char *argv[12];
argv[0] = "browser-wpadebug";
argv[1] = "start";
argv[2] = "-a";
argv[3] = "android.action.MAIN";
argv[4] = "-c";
argv[5] = "android.intent.category.LAUNCHER";
argv[6] = "-n";
argv[7] = "w1.fi.wpadebug/.WpaWebViewActivity";
argv[8] = "-e";
argv[9] = "w1.fi.wpadebug.URL";
argv[10] = (void *) url;
argv[11] = NULL;
execv("/system/bin/am", argv);
perror("execv");
exit(0);
return -1;
}
eloop_register_timeout(300, 0, browser_timeout, &data, NULL);
eloop_run();
eloop_cancel_timeout(browser_timeout, &data, NULL);