>From 689f6c5027ebf68696284ea8b1a53c69435f6940 Mon Sep 17 00:00:00 2001
From: Philipp Matthias Hahn <pmhahn@pmhahn.de>
Date: Thu, 1 May 2014 10:41:20 +0200
Subject: [PATCH 2/6] Directly use strdup()

commit 0edaf3361db01425cae0daee7dc3f6039f381a17 replaced several
malloc()+strcpy() sequences with memset()+strncpy() using strlen().
This doesn't improve security and introduced a bug URI handling.

While reviewing this commit change the code to directly use strdup()
instead of re-implementing it multiple times, as shortens the code and
thus improves readability.
---
 upnp/src/gena/gena_device.c          | 36 ++++++++----------------------------
 upnp/src/genlib/net/http/webserver.c |  4 +---
 2 files changed, 9 insertions(+), 31 deletions(-)

diff --git a/upnp/src/gena/gena_device.c b/upnp/src/gena/gena_device.c
index 39edc0b..3857856 100644
--- a/upnp/src/gena/gena_device.c
+++ b/upnp/src/gena/gena_device.c
@@ -480,25 +480,20 @@ int genaInitNotify(
 	}
 	*reference_count = 0;
 	
-	UDN_copy = (char *)malloc(strlen(UDN) + 1);
+	UDN_copy = strdup(UDN);
 	if (UDN_copy == NULL) {
 		line = __LINE__;
 		ret = UPNP_E_OUTOF_MEMORY;
 		goto ExitFunction;
 	}
 
-	servId_copy = (char *)malloc(strlen(servId) + 1);
+	servId_copy = strdup(servId);
 	if (servId_copy == NULL) {
 		line = __LINE__;
 		ret = UPNP_E_OUTOF_MEMORY;
 		goto ExitFunction;
 	}
 
-	memset(UDN_copy, 0, strlen(UDN) + 1);
-	strncpy(UDN_copy, UDN, strlen(UDN));
-	memset(servId_copy, 0, strlen(servId) + 1);
-	strncpy(servId_copy, servId, strlen(servId));
-
 	HandleLock();
 
 	if (GetHandleInfo(device_handle, &handle_info) != HND_DEVICE) {
@@ -639,25 +634,20 @@ int genaInitNotifyExt(
 	}
 	*reference_count = 0;
 	
-	UDN_copy = (char *)malloc(strlen(UDN) + 1);
+	UDN_copy = strdup(UDN);
 	if (UDN_copy == NULL) {
 		line = __LINE__;
 		ret = UPNP_E_OUTOF_MEMORY;
 		goto ExitFunction;
 	}
 
-	servId_copy = (char *)malloc(strlen(servId) + 1);
+	servId_copy = strdup(servId);
 	if( servId_copy == NULL ) {
 		line = __LINE__;
 		ret = UPNP_E_OUTOF_MEMORY;
 		goto ExitFunction;
 	}
 
-	memset(UDN_copy, 0, strlen(UDN) + 1);
-	strncpy(UDN_copy, UDN, strlen(UDN));
-	memset(servId_copy, 0, strlen(servId) + 1);
-	strncpy(servId_copy, servId, strlen(servId));
-
 	HandleLock();
 
 	if (GetHandleInfo(device_handle, &handle_info) != HND_DEVICE) {
@@ -798,25 +788,20 @@ int genaNotifyAllExt(
 	}
 	*reference_count = 0;
 	
-	UDN_copy = (char *)malloc(strlen(UDN) + 1);
+	UDN_copy = strdup(UDN);
 	if (UDN_copy == NULL) {
 		line = __LINE__;
 		ret = UPNP_E_OUTOF_MEMORY;
 		goto ExitFunction;
 	}
 
-	servId_copy = (char *)malloc(strlen(servId) + 1);
+	servId_copy = strdup(servId);
 	if( servId_copy == NULL ) {
 		line = __LINE__;
 		ret = UPNP_E_OUTOF_MEMORY;
 		goto ExitFunction;
 	}
 
-	memset(UDN_copy, 0, strlen(UDN) + 1);
-	strncpy(UDN_copy, UDN, strlen(UDN));
-	memset(servId_copy, 0, strlen(servId) + 1);
-	strncpy(servId_copy, servId, strlen(servId));
-
 	propertySet = ixmlPrintNode((IXML_Node *)PropSet);
 	if (propertySet == NULL) {
 		line = __LINE__;
@@ -944,25 +929,20 @@ int genaNotifyAll(
 	}
 	*reference_count = 0;
 	
-	UDN_copy = (char *)malloc(strlen(UDN) + 1);
+	UDN_copy = strdup(UDN);
 	if (UDN_copy == NULL) {
 		line = __LINE__;
 		ret = UPNP_E_OUTOF_MEMORY;
 		goto ExitFunction;
 	}
 
-	servId_copy = (char *)malloc(strlen(servId) + 1);
+	servId_copy = strdup(servId);
 	if( servId_copy == NULL ) {
 		line = __LINE__;
 		ret = UPNP_E_OUTOF_MEMORY;
 		goto ExitFunction;
 	}
 
-	memset(UDN_copy, 0, strlen(UDN) + 1);
-	strncpy(UDN_copy, UDN, strlen(UDN));
-	memset(servId_copy, 0, strlen(servId) + 1);
-	strncpy(servId_copy, servId, strlen(servId));
-
 	ret = GeneratePropertySet(VarNames, VarValues, var_count, &propertySet);
 	if (ret != XML_SUCCESS) {
 		line = __LINE__;
diff --git a/upnp/src/genlib/net/http/webserver.c b/upnp/src/genlib/net/http/webserver.c
index b07b0b3..1f6f4a4 100644
--- a/upnp/src/genlib/net/http/webserver.c
+++ b/upnp/src/genlib/net/http/webserver.c
@@ -792,11 +792,9 @@ static int CreateHTTPRangeResponseHeader(
 	Instr->ReadSendSize = FileLength;
 	if (!ByteRangeSpecifier)
 		return HTTP_BAD_REQUEST;
-	RangeInput = malloc(strlen(ByteRangeSpecifier) + 1);
+	RangeInput = strdup(ByteRangeSpecifier);
 	if (!RangeInput)
 		return HTTP_INTERNAL_SERVER_ERROR;
-	memset(RangeInput, 0, strlen(ByteRangeSpecifier) + 1);
-	strncpy(RangeInput, ByteRangeSpecifier, strlen(ByteRangeSpecifier));
 	/* CONTENT-RANGE: bytes 222-3333/4000  HTTP_PARTIAL_CONTENT */
 	if (StrStr(RangeInput, "bytes") == NULL ||
 	    (Ptr = StrStr(RangeInput, "=")) == NULL) {
-- 
2.0.0.rc0

