abrt-hook-python: add input sanitization and directory size guard

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 23 insertions, 16 deletions

diff --git a/src/Hooks/abrt-hook-python.cpp b/src/Hooks/abrt-hook-python.cpp
index 3f79d28a..406cd829 100644
--- a/src/Hooks/abrt-hook-python.cpp
+++ b/src/Hooks/abrt-hook-python.cpp
@@ -24,12 +24,14 @@
 /* We can easily get rid of abrtlib (libABRTUtils.so) usage in this file,
  * but DebugDump will pull it in anyway */
 #include "abrtlib.h"
+#include "hooklib.h"
 #include "DebugDump.h"
 #if HAVE_CONFIG_H
 # include <config.h>
 #endif
 
 #define MAX_BT_SIZE (1024*1024)
+#define MAX_BT_SIZE_STR "1 MB"
 
 static char *pid;
 static char *executable;
@@ -74,9 +76,15 @@ int main(int argc, char** argv)
       );
     }
   }
-  if (!pid)
+  if (!pid || !executable || !uuid)
     goto usage;
-// is it really ok if other params aren't specified? abrtd might get confused...
+
+  unsigned setting_MaxCrashReportsSize = 0;
+  parse_conf(NULL, &setting_MaxCrashReportsSize, NULL);
+  if (setting_MaxCrashReportsSize > 0)
+  {
+    check_free_space(setting_MaxCrashReportsSize);
+  }
 
   // Read the backtrace from stdin
   char *bt = (char*)xmalloc(MAX_BT_SIZE);
@@ -88,35 +96,34 @@ int main(int argc, char** argv)
   bt[len] = '\0';
   if (len == MAX_BT_SIZE-1)
   {
-    error_msg("Backtrace size limit exceeded, trimming to 1 MB");
+    error_msg("Backtrace size limit exceeded, trimming to " MAX_BT_SIZE_STR);
   }
 
+  char *cmdline = get_cmdline(xatou(pid)); /* never NULL */
+
   // Create directory with the debug dump
   char path[PATH_MAX];
   snprintf(path, sizeof(path), DEBUG_DUMPS_DIR"/pyhook-%ld-%s",
 	   (long)time(NULL), pid);
-
   CDebugDump dd;
   dd.Create(path, geteuid());
-  dd.SaveText(FILENAME_ANALYZER, "Python");
-  if (executable)
-    dd.SaveText(FILENAME_EXECUTABLE, executable);
 
-  pid_t pidt = xatoi(pid);
-  char *cmdline = get_cmdline(pidt);
+  dd.SaveText(FILENAME_ANALYZER, "Python");
+  dd.SaveText(FILENAME_EXECUTABLE, executable);
+  dd.SaveText("backtrace", bt);
+  free(bt);
   dd.SaveText("cmdline", cmdline);
   free(cmdline);
-
-  if (uuid)
-    dd.SaveText("uuid", uuid);
-
+  dd.SaveText("uuid", uuid);
   char uid[sizeof(int) * 3 + 2];
-  sprintf(uid, "%d", (int)getuid());
+  sprintf(uid, "%u", (unsigned)getuid());
   dd.SaveText("uid", uid);
 
-  dd.SaveText("backtrace", bt);
-  free(bt);
   dd.Close();
+  if (setting_MaxCrashReportsSize > 0)
+  {
+    trim_debug_dumps(setting_MaxCrashReportsSize, path);
+  }
 
   return 0;
 }