X-Git-Url: http://git.maemo.org/git/?p=browser-switch;a=blobdiff_plain;f=launcher.c;h=24dff0a14151f3da405443c81011ac0f8d64e1da;hp=c8972998d91652f2865493cc715d82b98671f638;hb=a9b3f951dddb14ac0188e3e451325592267a22d5;hpb=42f0af690415fc59317203a187501c00c012c9d9

diff --git a/launcher.c b/launcher.c
index c897299..24dff0a 100644
--- a/launcher.c
+++ b/launcher.c
@@ -46,17 +46,13 @@ static void launch_tear(struct swb_context *ctx, char *uri) {
 	printf("launch_tear with uri '%s'\n", uri);
 
 	status = system("pidof tear > /dev/null");
-	if (!WIFEXITED(status))
-		exit(1);
-	if (!WEXITSTATUS(status)) {
+	if (WIFEXITED(status) && !WEXITSTATUS(status)) {
 		if (!tear_proxy)
 			tear_proxy = dbus_g_proxy_new_for_name(ctx->session_bus,
 				       	"com.nokia.tear", "/com/nokia/tear",
 					"com.nokia.Tear");
-		dbus_g_proxy_call(tear_proxy, "OpenAddress",
-				&error,
-				G_TYPE_STRING, uri,
-				G_TYPE_INVALID);
+		dbus_g_proxy_call(tear_proxy, "OpenAddress", &error,
+				  G_TYPE_STRING, uri, G_TYPE_INVALID);
 		if (!ctx->continuous_mode)
 			exit(0);
 	} else {
@@ -82,9 +78,7 @@ void launch_microb(struct swb_context *ctx, char *uri) {
 		uri = "new_window";
 
 	status = system("pidof /usr/sbin/browserd > /dev/null");
-	if (!WIFEXITED(status))
-		exit(1);
-	if (WEXITSTATUS(status)) {
+	if (WIFEXITED(status) && WEXITSTATUS(status)) {
 		kill_browserd = 1;
 		system("/usr/sbin/browserd -d");
 	}
@@ -102,10 +96,10 @@ void launch_microb(struct swb_context *ctx, char *uri) {
 		/* Child process */
 		if (!strcmp(uri, "new_window")) {
 			execl("/usr/bin/maemo-invoker",
-				       "browser", (char *)NULL);
+			      "browser", (char *)NULL);
 		} else {
 			execl("/usr/bin/maemo-invoker",
-					"browser", "--url", uri, (char *)NULL);
+			      "browser", "--url", uri, (char *)NULL);
 		}
 	}
 
@@ -123,6 +117,8 @@ static void launch_other_browser(struct swb_context *ctx, char *uri) {
 	char *quoted_uri, *quote;
 
 	size_t cmdlen, urilen;
+	size_t quoted_uri_size;
+	size_t offset;
 
 	if (!uri || !strcmp(uri, "new_window"))
 		uri = "";
@@ -132,23 +128,33 @@ static void launch_other_browser(struct swb_context *ctx, char *uri) {
 		/* urilen+3 = length of URI + 2x \' + \0 */
 		if (!(quoted_uri = calloc(urilen+3, sizeof(char))))
 			exit(1);
-		strncpy(quoted_uri+1, uri, urilen);
-		quoted_uri[0] = quoted_uri[urilen+1] = '\'';
-		/* calloc zeroes the memory, so string is automatically
-		   null terminated */
+		snprintf(quoted_uri, urilen+3, "'%s'", uri);
 
 		/* If there are any 's in the original URI, URL-escape them
 		   (replace them with %27) */
+		quoted_uri_size = urilen + 3;
 		quote = quoted_uri + 1;
 		while ((quote = strchr(quote, '\'')) &&
-				(quote-quoted_uri) < strlen(quoted_uri)-1) {
-			/* 3 = strlen("%27")-strlen("'") + \0 */
+		       (offset = quote-quoted_uri) < strlen(quoted_uri)-1) {
+			/* Check to make sure we don't shrink the memory area
+			   as a result of integer overflow */
+			if (quoted_uri_size+2 <= quoted_uri_size)
+				exit(1);
+
+			/* Grow the memory area;
+			   2 = strlen("%27")-strlen("'") */
 			if (!(quoted_uri = realloc(quoted_uri,
-							strlen(quoted_uri)+3)))
+						   quoted_uri_size+2)))
 				exit(1);
+			quoted_uri_size = quoted_uri_size + 2;
+
+			/* Recalculate the location of the ' character --
+			   realloc() may have moved the string in memory */
+			quote = quoted_uri + offset;
+
 			/* Move the string after the ', including the \0,
 			   over two chars */
-			memmove(quote+3, quote+1, strlen(quote)+1);
+			memmove(quote+3, quote+1, strlen(quote));
 			memcpy(quote, "%27", 3);
 			quote = quote + 3;
 		}
@@ -190,8 +196,7 @@ static void use_other_browser_cmd(struct swb_context *ctx, char *cmd) {
 		ctx->default_browser_launcher = LAUNCH_DEFAULT_BROWSER;
 	} else {
 		ctx->other_browser_cmd = strncpy(ctx->other_browser_cmd,
-				cmd, len);
-		ctx->other_browser_cmd[len] = '\0';
+						 cmd, len+1);
 		ctx->default_browser_launcher = launch_other_browser;
 	}
 }