From 6e2372a86c7e862ed931910f8a5f4b908639d689 Mon Sep 17 00:00:00 2001
From: Rich Felker <dalias@aerifal.cx>
Date: Sun, 30 Sep 2012 17:53:54 -0400
Subject: [PATCH] clean up, bugfixes, and general improvement for
 shm_open/shm_unlink

1. don't make non-cloexec file descriptors
2. cancellation safety (cleanup handlers were missing, now unneeded)
3. share name validation/mapping code between open/unlink functions
4. avoid wasteful/slow syscalls
---
 src/mman/shm_open.c   | 37 ++++++++++++++++++++++++++++---------
 src/mman/shm_unlink.c | 21 ---------------------
 2 files changed, 28 insertions(+), 30 deletions(-)
 delete mode 100644 src/mman/shm_unlink.c

diff --git a/src/mman/shm_open.c b/src/mman/shm_open.c
index d368622d..a9be899b 100644
--- a/src/mman/shm_open.c
+++ b/src/mman/shm_open.c
@@ -3,19 +3,38 @@
 #include <fcntl.h>
 #include <unistd.h>
 #include <string.h>
+#include <limits.h>
 
-int shm_open(const char *name, int flag, mode_t mode)
-{
-	int fd, dir;
+char *__strchrnul(const char *, int);
 
+static const char *mapname(const char *name, char *buf)
+{
+	char *p;
 	while (*name == '/') name++;
-	if (strchr(name, '/')) {
+	if (*(p = __strchrnul(name, '/')) || p==name ||
+	    (p-name <= 2 && name[0]=='.' && p[-1]=='.')) {
 		errno = EINVAL;
-		return -1;
+		return 0;
 	}
+	if (p-name > NAME_MAX) {
+		errno = ENAMETOOLONG;
+		return 0;
+	}
+	memcpy(buf, "/dev/shm/", 9);
+	memcpy(buf+9, name, p-name+1);
+	return buf;
+}
 
-	if ((dir = open("/dev/shm", O_DIRECTORY|O_RDONLY)) < 0) return -1;
-	fd = openat(dir, name, flag|O_NOFOLLOW|O_CLOEXEC|O_NONBLOCK, mode);
-	close(dir);
-	return fd;
+int shm_open(const char *name, int flag, mode_t mode)
+{
+	char buf[NAME_MAX+10];
+	if (!(name = mapname(name, buf))) return -1;
+	return open(name, flag|O_NOFOLLOW|O_CLOEXEC|O_NONBLOCK, mode);
+}
+
+int shm_unlink(const char *name)
+{
+	char buf[NAME_MAX+10];
+	if (!(name = mapname(name, buf))) return -1;
+	return unlink(name);
 }
diff --git a/src/mman/shm_unlink.c b/src/mman/shm_unlink.c
deleted file mode 100644
index 46e60b3b..00000000
--- a/src/mman/shm_unlink.c
+++ /dev/null
@@ -1,21 +0,0 @@
-#include <sys/mman.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <string.h>
-
-int shm_unlink(const char *name)
-{
-	int dir, ret;
-
-	while (*name == '/') name++;
-	if (strchr(name, '/')) {
-		errno = EINVAL;
-		return -1;
-	}
-
-	if ((dir = open("/dev/shm", O_DIRECTORY|O_RDONLY)) < 0) return -1;
-	ret = unlinkat(dir, name, 0);
-	close(dir);
-	return ret;
-}
-- 
2.20.1