From 26e1c2dd9b4816d902fd8755c5661090a0a6816d Mon Sep 17 00:00:00 2001
From: patacongo <patacongo@42af7a65-404d-4744-a932-0658087f49c3>
Date: Sun, 13 Sep 2009 20:14:51 +0000
Subject: [PATCH] CGI tried to execute using relative path

git-svn-id: svn://svn.code.sf.net/p/nuttx/code/trunk@2047 42af7a65-404d-4744-a932-0658087f49c3
---
 netutils/thttpd/libhttpd.c     |  4 ++--
 netutils/thttpd/thttpd_alloc.c | 19 +++++++++++++++++++
 netutils/thttpd/thttpd_alloc.h |  4 ++++
 netutils/thttpd/thttpd_cgi.c   | 30 +++++++++++-------------------
 4 files changed, 36 insertions(+), 21 deletions(-)

diff --git a/netutils/thttpd/libhttpd.c b/netutils/thttpd/libhttpd.c
index d3703586bd..0c0fd270cc 100644
--- a/netutils/thttpd/libhttpd.c
+++ b/netutils/thttpd/libhttpd.c
@@ -2149,9 +2149,9 @@ FAR httpd_server *httpd_initialize(FAR httpd_sockaddr *sa)
     }
 
 #ifdef CONFIG_THTTPD_HOSTNAME
-  hs->hostname = strdup(CONFIG_THTTPD_HOSTNAME);
+  hs->hostname = httpd_strdup(CONFIG_THTTPD_HOSTNAME);
 #else
-  hs->hostname = strdup(httpd_ntoa(sa));
+  hs->hostname = httpd_strdup(httpd_ntoa(sa));
 #endif
   nvdbg("hostname: %s\n", hs->hostname);
 
diff --git a/netutils/thttpd/thttpd_alloc.c b/netutils/thttpd/thttpd_alloc.c
index 85f79adc46..a4d64e3c6d 100755
--- a/netutils/thttpd/thttpd_alloc.c
+++ b/netutils/thttpd/thttpd_alloc.c
@@ -147,6 +147,25 @@ void httpd_free(FAR void *ptr)
 }
 #endif
 
+#ifdef CONFIG_THTTPD_MEMDEBUG
+FAR char *httpd_strdup(const char *str)
+{
+  FAR char *newstr = strdup(str);
+  if (!newstr)
+    {
+      ndbg("strdup of %s failed\n", str);
+    }
+  else
+    {
+      nvdbg("strdup'ed %s\n", str);
+      g_nallocations++;
+      g_allocated += (strlen(str)+1);
+    }
+  httpd_memstats();
+  return newstr;
+}
+#endif
+
 /* Helpers to implement dynamically allocated strings */
 
 void httpd_realloc_str(char **pstr, size_t *maxsize, size_t size)
diff --git a/netutils/thttpd/thttpd_alloc.h b/netutils/thttpd/thttpd_alloc.h
index c20834965e..1f24bc2e95 100755
--- a/netutils/thttpd/thttpd_alloc.h
+++ b/netutils/thttpd/thttpd_alloc.h
@@ -41,6 +41,8 @@
  ****************************************************************************/
 
 #include <nuttx/config.h>
+#include <stdlib.h>
+#include <string.h>
 #include "config.h"
 
 #ifdef CONFIG_THTTPD
@@ -55,10 +57,12 @@
 extern FAR void *httpd_malloc(size_t nbytes);
 extern FAR void *httpd_realloc(FAR void *oldptr, size_t oldsize, size_t newsize);
 extern void      httpd_free(FAR void *ptr);
+extern FAR char *httpd_strdup(const char *str);
 #else
 #  define httpd_malloc(n)      malloc(n)
 #  define httpd_realloc(p,o,n) realloc(p,n)
 #  define httpd_free(p)        free(p)
+#  define httpd_strdup(s)      strdup(s)
 #endif
 
 /* Helpers to support allocations in multiples of a type size */
diff --git a/netutils/thttpd/thttpd_cgi.c b/netutils/thttpd/thttpd_cgi.c
index 94fceff827..cf5ee50761 100755
--- a/netutils/thttpd/thttpd_cgi.c
+++ b/netutils/thttpd/thttpd_cgi.c
@@ -46,6 +46,7 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <string.h>
+#include <libgen.h>
 #include <errno.h>
 #include <debug.h>
 
@@ -632,8 +633,8 @@ static int cgi_child(int argc, char **argv)
   struct cgi_outbuffer_s hdr;
   struct fdwatch_s *fw;
   char   *buffer;
-  char   *binary;
   char   *directory;
+  char   *dupname;
   boolean indone;
   boolean outdone;
   int     child;
@@ -741,28 +742,19 @@ static int cgi_child(int argc, char **argv)
         }
     }
 
-  /* Split the program into directory and binary, so we can chdir() to the
-   * program's own directory.  This isn't in the CGI 1.1 spec, but it's what 
-   * other HTTP servers do.
+  /* chdir to the directory containing the binary. This isn't in the CGI 1.1
+   * spec, but it's what  other HTTP servers do.
    */
 
-  directory = strdup(hc->expnfilename);
-  if (!directory)
+  dupname = httpd_strdup(hc->expnfilename);
+  if (dupname)
     {
-      binary = hc->expnfilename;  /* ignore errors */
-    }
-  else
-    {
-      binary = strrchr(directory, '/');
-      if (!binary)
+      directory = dirname(dupname);
+      if (directory)
         {
-          binary = hc->expnfilename;
-        }
-      else
-        {
-          *binary++ = '\0';
-          (void)chdir(directory);       /* ignore errors */
+          (void)chdir(directory); /* ignore errors */
         }
+      httpd_free(dupname);
     }
 
   /* Allocate memory for buffering */
@@ -794,7 +786,7 @@ static int cgi_child(int argc, char **argv)
   /* Run the CGI program. */
 
   nllvdbg("Starting CGI\n");
-  child = exec(binary, (FAR const char **)argp, g_thttpdsymtab, g_thttpdnsymbols);
+  child = exec(hc->expnfilename, (FAR const char **)argp, g_thttpdsymtab, g_thttpdnsymbols);
   if (child < 0)
     {
       /* Something went wrong. */