pd-mapper: Null terminate firmware_value string

Null terminate firmware_value string to prevent
strlen() read past the end of buffer error on AOSP.

Otherwise pd-mapper will crash:
  console:/ # pd-mapper
  FORTIFY: strlen: detected read past end of buffer
  Aborted
  134|console:/ #

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

Android.bp

@@ -0,0 +1,9 @@
+cc_binary {
+    name: "pd-mapper",
+    vendor: true,
+    srcs: [
+	"pd-mapper.c",
+	"servreg_loc.c",
+    ],
+    shared_libs: ["libqrtr"],
+}

Makefile

@@ -3,7 +3,12 @@ PD_MAPPER := pd-mapper
 CFLAGS := -Wall -g -O2
 LDFLAGS := -lqrtr
 
+prefix ?= /usr/local
+bindir := $(prefix)/bin
+servicedir := $(prefix)/lib/systemd/system
+
 SRCS := pd-mapper.c \
+        assoc.c \
         json.c \
 	servreg_loc.c
 
@@ -12,8 +17,12 @@ OBJS := $(SRCS:.c=.o)
 $(PD_MAPPER): $(OBJS)
 	$(CC) -o $@ $^ $(LDFLAGS)
 
-install: $(PD_MAPPER)
+pd-mapper.service: pd-mapper.service.in
-	install -D -m 755 $< $(DESTDIR)$(prefix)/bin/$<
+	@sed 's+PD_MAPPER_PATH+$(bindir)+g' $< > $@
+
+install: $(PD_MAPPER) pd-mapper.service
+	@install -D -m 755 $(PD_MAPPER) $(DESTDIR)$(bindir)/$(PD_MAPPER)
+	@install -D -m 644 pd-mapper.service $(DESTDIR)$(servicedir)/pd-mapper.service
 
 clean:
-	rm -f $(PD_MAPPER) $(OBJS)
+	rm -f $(PD_MAPPER) $(OBJS) pd-mapper.service

assoc.c

@@ -0,0 +1,158 @@
+/*
+ * Copyright (c) 2013, Bjorn Andersson <bjorn@kryo.se>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ * may be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "assoc.h"
+
+static unsigned long assoc_hash(const char *value)
+{
+	unsigned long hash = 0;
+	unsigned long g;
+	const char *v = value;
+
+	while (*v) {
+		hash = (hash << 4) + *(v++);
+		g = hash & 0xF0000000L;
+		if (g)
+			hash ^= g >> 24;
+		hash &= ~g;
+	}
+
+	return hash;
+}
+
+void assoc_init(struct assoc *assoc, unsigned long size)
+{
+	assert(size > 0);
+
+	assoc->size = size;
+	assoc->fill = 0;
+	assoc->keys = calloc(size, sizeof(const char *));
+	assoc->values = malloc(size * sizeof(void *));
+}
+
+void *assoc_get(struct assoc *assoc, const char *key)
+{
+	unsigned long hash;
+
+	hash = assoc_hash(key) % assoc->size;
+	while (assoc->keys[hash]) {
+		if (!strcmp(assoc->keys[hash], key))
+			return assoc->values[hash];
+
+		hash = (hash + 1) % assoc->size;
+	}
+
+	return NULL;
+}
+
+static void _assoc_set(struct assoc *assoc, const char *key, void *value)
+{
+	struct assoc new_set;
+	unsigned long hash;
+	unsigned long i;
+
+	assert(assoc->fill < assoc->size);
+
+	/* Grow set at 80% utilization */
+	if (5 * assoc->fill > 4 * assoc->size) {
+		assoc_init(&new_set, assoc->size * 5 / 4);
+
+		for (i = 0; i < assoc->size; i++)
+			if (assoc->keys[i])
+				assoc_set(&new_set, assoc->keys[i],
+					  assoc->values[i]);
+
+		free(assoc->keys);
+		free(assoc->values);
+
+		assoc->keys = new_set.keys;
+		assoc->values = new_set.values;
+		assoc->fill = new_set.fill;
+		assoc->size = new_set.size;
+	}
+
+	hash = assoc_hash(key) % assoc->size;
+	while (assoc->keys[hash]) {
+		if (!strcmp(assoc->keys[hash], key)) {
+			assoc->values[hash] = value;
+			return;
+		}
+
+		hash = (hash + 1) % assoc->size;
+	}
+
+	assoc->keys[hash] = key;
+	assoc->values[hash] = value;
+	assoc->fill++;
+}
+
+void assoc_set(struct assoc *assoc, const char *key, void *value)
+{
+	_assoc_set(assoc, strdup(key), value);
+}
+
+const char *assoc_next(struct assoc *assoc, void **value, unsigned long *iter)
+{
+	unsigned long it = *iter;
+
+	while (it < assoc->size && !assoc->keys[it])
+		it++;
+
+	if (it == assoc->size)
+		return NULL;
+
+	*iter = it + 1;
+
+	if (it < assoc->size) {
+		if (value)
+			*value = assoc->values[it];
+		return assoc->keys[it];
+	} else {
+		return NULL;
+	}
+}
+
+void assoc_destroy(struct assoc *assoc)
+{
+	unsigned long i;
+
+	for (i = 0; i < assoc->size; i++)
+		free((void*)assoc->keys[i]);
+
+	free(assoc->keys);
+	free(assoc->values);
+	assoc->size = 0;
+}

assoc.h

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2013, Bjorn Andersson <bjorn@kryo.se>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ * may be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __ASSOC_H__
+#define __ASSOC_H__
+
+struct assoc {
+	unsigned long size;
+	unsigned long fill;
+
+	const char **keys;
+	void **values;
+};
+
+void assoc_init(struct assoc *assoc, unsigned long size);
+void *assoc_get(struct assoc *assoc, const char *key);
+void assoc_set(struct assoc *assoc, const char *key, void *value);
+const char *assoc_next(struct assoc *assoc, void **value, unsigned long *iter);
+void assoc_destroy(struct assoc *assoc);
+
+#define assoc_foreach(key, value, assoc, iter) \
+	for ((iter) = 0, (key) = assoc_next((assoc), (value), &(iter)); \
+	     (key); \
+	     (key) = assoc_next((assoc), (value), &(iter)))
+
+#endif

json.c

@@ -81,7 +81,7 @@ static int json_parse_string(struct json_value *value)
 		return 0;
 	}
 
-	while ((ch = input()) && ch != '"')
+	while ((ch = input()) && ch != '"' && b - buf < sizeof(buf) - 1)
 		*b++ = ch;
 	*b = '\0';
 
@@ -350,7 +350,7 @@ struct json_value *json_parse_file(const char *file)
 
 	ret = json_parse_value(root);
 	if (ret != 1) {
-		free(root);
+		json_free(root);
 		return NULL;
 	}
 

pd-mapper.c

@@ -28,13 +28,21 @@
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <err.h>
 #include <errno.h>
+#include <dirent.h>
+#include <fcntl.h>
+#include <libgen.h>
 #include <libqrtr.h>
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
+#include "assoc.h"
 #include "json.h"
 #include "servreg_loc.h"
 
@@ -111,7 +119,7 @@ respond:
 	}
 }
 
-static int pd_maps_load(const char *file)
+static int pd_load_map(const char *file)
 {
 	static int num_pd_maps;
 	struct json_value *sr_service;
@@ -185,6 +193,115 @@ static int pd_maps_load(const char *file)
 	return 0;
 }
 
+#define FIRMWARE_BASE	"/lib/firmware/"
+
+static int pd_enumerate_jsons(struct assoc *json_set)
+{
+	char firmware_value[PATH_MAX];
+	char json_path[PATH_MAX];
+	char firmware_attr[32];
+	struct dirent *fw_de;
+	char path[PATH_MAX];
+	struct dirent *de;
+	int firmware_fd;
+	DIR *class_dir;
+	int class_fd;
+	DIR *fw_dir;
+	size_t len;
+	size_t n;
+
+	class_fd = open("/sys/class/remoteproc", O_RDONLY | O_DIRECTORY);
+	if (class_fd < 0) {
+		warn("failed to open remoteproc class");
+		return -1;
+	}
+
+	class_dir = fdopendir(class_fd);
+	if (!class_dir) {
+		warn("failed to opendir");
+		goto close_class;
+	}
+
+	while ((de = readdir(class_dir)) != NULL) {
+		if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
+			continue;
+
+		if (strlen(de->d_name) + sizeof("/firmware") > sizeof(firmware_attr))
+			continue;
+
+		strcpy(firmware_attr, de->d_name);
+		strcat(firmware_attr, "/firmware");
+
+		firmware_fd = openat(class_fd, firmware_attr, O_RDONLY);
+		if (firmware_fd < 0)
+			continue;
+
+		n = read(firmware_fd, firmware_value, sizeof(firmware_value));
+		close(firmware_fd);
+		if (n < 0) {
+			continue;
+		}
+
+		firmware_value[n] = '\0';
+
+		if (strlen(FIRMWARE_BASE) + strlen(firmware_value) + 1 > sizeof(path))
+			continue;
+
+		strcpy(path, FIRMWARE_BASE);
+		strcat(path, dirname(firmware_value));
+
+		fw_dir = opendir(path);
+		while ((fw_de = readdir(fw_dir)) != NULL) {
+			if (!strcmp(fw_de->d_name, ".") || !strcmp(fw_de->d_name, ".."))
+				continue;
+
+			len = strlen(fw_de->d_name);
+			if (len < 5 || strcmp(&fw_de->d_name[len - 4], ".jsn"))
+				continue;
+
+			if (strlen(FIRMWARE_BASE) + strlen(firmware_value) + 1 +
+			    strlen(fw_de->d_name) + 1 > sizeof(path))
+					continue;
+
+			strcpy(json_path, path);
+			strcat(json_path, "/");
+			strcat(json_path, fw_de->d_name);
+
+			assoc_set(json_set, json_path, NULL);
+		}
+
+		closedir(fw_dir);
+	}
+
+	closedir(class_dir);
+close_class:
+	close(class_fd);
+
+	return 0;
+}
+
+static int pd_load_maps(void)
+{
+	struct assoc json_set;
+	unsigned long it;
+	const char *jsn;
+	int ret = 0;
+
+	assoc_init(&json_set, 20);
+
+	pd_enumerate_jsons(&json_set);
+
+	assoc_foreach(jsn, NULL, &json_set, it) {
+		ret = pd_load_map(jsn);
+		if (ret < 0)
+			break;
+	}
+
+	assoc_destroy(&json_set);
+
+	return ret;
+}
+
 int main(int argc, char **argv)
 {
 	struct sockaddr_qrtr sq;
@@ -194,13 +311,10 @@ int main(int argc, char **argv)
 	char buf[4096];
 	int ret;
 	int fd;
-	int i;
 
-	for (i = 1; i < argc; i++) {
+	ret = pd_load_maps();
-		ret = pd_maps_load(argv[i]);
+	if (ret)
-		if (ret)
+		exit(1);
-			exit(1);
-	}
 
 	if (!pd_maps) {
 		fprintf(stderr, "no pd maps available\n");

pd-mapper.service.in

@@ -0,0 +1,11 @@
+[Unit]
+Description=Qualcomm PD mapper service
+Requires=qrtr-ns.service
+After=qrtr-ns.service
+
+[Service]
+ExecStart=PD_MAPPER_PATH/pd-mapper
+Restart=always
+
+[Install]
+WantedBy=multi-user.target