Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .SRCINFO
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
pkgbase = coolerdash
pkgdesc = Extends CoolerControl with a polished LCD dashboard
pkgver = 1.83
pkgver = 1.84
pkgrel = 1
url = https://github.com/damachine/coolerdash
install = coolerdash.install
Expand Down
2 changes: 1 addition & 1 deletion VERSION
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.83
1.84
31 changes: 28 additions & 3 deletions src/config.c
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,24 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
// cppcheck-suppress-end missingIncludeSystem

// Include project headers
#include "config.h"
#include "coolercontrol.h"

// Define O_NOFOLLOW if not defined (for portability)
#ifndef O_NOFOLLOW
#define O_NOFOLLOW 0
#endif

// Ensure fdopen is declared if not available in the environment
#ifndef HAVE_DECL_FDOPEN
FILE *fdopen(int fd, const char *mode);
#endif

/**
* @brief Global logging implementation for all modules except main.c
* @details Provides unified log output for info, status, warning and error messages.
Expand Down Expand Up @@ -735,12 +747,25 @@
// Initialize config struct with zeros to ensure fallbacks work
memset(config, 0, sizeof(Config));

// Check if file exists and is readable
FILE *file = fopen(path, "r");
// Sicheres Öffnen der Konfigurationsdatei
int cfd = open(path, O_RDONLY | O_NOFOLLOW);

Check warning

Code scanning / Flawfinder (reported by Codacy)

Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). Warning

Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).
FILE *file = NULL;
if (cfd != -1)
{
struct stat cst;

Check notice

Code scanning / Cppcheck (reported by Codacy)

stat is Y2038-unsafe Note

stat is Y2038-unsafe
if (fstat(cfd, &cst) == 0 && S_ISREG(cst.st_mode))

Check notice

Code scanning / Cppcheck (reported by Codacy)

fstat is Y2038-unsafe Note

fstat is Y2038-unsafe

Check notice

Code scanning / Cppcheck (reported by Codacy)

MISRA 12.1 rule Note

MISRA 12.1 rule
{
file = fdopen(cfd, "r");
}
else
{
close(cfd);
}
}
if (!file)
{
// File doesn't exist - use fallbacks only
log_message(LOG_INFO, "Config file '%s' not found, using fallback values", path);
log_message(LOG_INFO, "Config file '%s' not found oder nicht regulär, using fallback values", path);
get_config_defaults(config);
return 0; // Return success, fallbacks are valid
}
Expand Down
65 changes: 50 additions & 15 deletions src/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -87,14 +87,38 @@
return version_buffer[0] ? version_buffer : DEFAULT_VERSION;
}

// Try to read from VERSION file
FILE *fp = fopen("VERSION", "r");
// Try to read from VERSION file sicher
int vfd = open("VERSION", O_RDONLY | O_NOFOLLOW);

Check warning

Code scanning / Flawfinder (reported by Codacy)

Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). Warning

Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).
FILE *fp = NULL;
if (vfd != -1)
{
struct stat vst;

Check notice

Code scanning / Cppcheck (reported by Codacy)

stat is Y2038-unsafe Note

stat is Y2038-unsafe
if (fstat(vfd, &vst) == 0 && S_ISREG(vst.st_mode))

Check notice

Code scanning / Cppcheck (reported by Codacy)

fstat is Y2038-unsafe Note

fstat is Y2038-unsafe

Check notice

Code scanning / Cppcheck (reported by Codacy)

MISRA 12.1 rule Note

MISRA 12.1 rule
{
fp = fdopen(vfd, "r");
}
else
{
close(vfd);
}
}
if (!fp)
{
// Try alternative path for installed version
fp = fopen("/opt/coolerdash/VERSION", "r");
vfd = open("/opt/coolerdash/VERSION", O_RDONLY | O_NOFOLLOW);

Check warning

Code scanning / Flawfinder (reported by Codacy)

Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). Warning

Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).
if (vfd != -1)
{
struct stat vst2;

Check notice

Code scanning / Cppcheck (reported by Codacy)

stat is Y2038-unsafe Note

stat is Y2038-unsafe
if (fstat(vfd, &vst2) == 0 && S_ISREG(vst2.st_mode))

Check notice

Code scanning / Cppcheck (reported by Codacy)

fstat is Y2038-unsafe Note

fstat is Y2038-unsafe

Check notice

Code scanning / Cppcheck (reported by Codacy)

MISRA 12.1 rule Note

MISRA 12.1 rule
{
fp = fdopen(vfd, "r");
}
else
{
close(vfd);
}
}
}

if (!fp)
{
log_message(LOG_WARNING, "Could not open VERSION file, using default version");
Expand Down Expand Up @@ -480,21 +504,32 @@
return;
}

// Check if shutdown image file exists
FILE *image_file = fopen(shutdown_image_path, "r");
if (image_file)
// Check if shutdown image file exists and is a regular file
int img_fd = open(shutdown_image_path, O_RDONLY | O_NOFOLLOW);

Check warning

Code scanning / Flawfinder (reported by Codacy)

Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). Warning

Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).
if (img_fd != -1)
{
// Image exists, send it normally
fclose(image_file);
send_image_to_lcd(g_config_ptr, shutdown_image_path, device_uid);
send_image_to_lcd(g_config_ptr, shutdown_image_path, device_uid); // Send twice for better reliability
struct stat img_st;

Check notice

Code scanning / Cppcheck (reported by Codacy)

stat is Y2038-unsafe Note

stat is Y2038-unsafe
if (fstat(img_fd, &img_st) == 0 && S_ISREG(img_st.st_mode))

Check notice

Code scanning / Cppcheck (reported by Codacy)

MISRA 12.1 rule Note

MISRA 12.1 rule

Check notice

Code scanning / Cppcheck (reported by Codacy)

fstat is Y2038-unsafe Note

fstat is Y2038-unsafe
{
// Send shutdown image to LCD
close(img_fd);
send_image_to_lcd(g_config_ptr, shutdown_image_path, device_uid);
send_image_to_lcd(g_config_ptr, shutdown_image_path, device_uid); // Send twice for better reliability
}
else
{
// Not a regular file
close(img_fd);
log_message(LOG_WARNING, "Shutdown image '%s' ist kein reguläres File oder nicht lesbar", shutdown_image_path);
goto shutdown_image_missing;

Check notice

Code scanning / Cppcheck (reported by Codacy)

MISRA 15.1 rule Note

MISRA 15.1 rule

Check notice

Code scanning / Cppcheck (reported by Codacy)

MISRA 15.3 rule Note

MISRA 15.3 rule
}
}
else
{
// Image doesn't exist, create temporary config with brightness 0 to turn off LCD
log_message(LOG_WARNING, "Shutdown image '%s' not found, turning off LCD display", shutdown_image_path);

// Create a temporary config copy with brightness set to 0
// File doesn't exist or can't be opened
log_message(LOG_WARNING, "Shutdown image '%s' nicht gefunden oder nicht lesbar, turning off LCD display", shutdown_image_path);
// Fallback to turning off the display
shutdown_image_missing:
Config temp_config = *g_config_ptr;
temp_config.lcd_brightness = 0;

Expand Down