Blame SOURCES/libcgroup-0.41-api.c-fix-potential-buffer-overflow.patch

0a7b38
From 1b4b4b7f8d4443c3e630838c9b33c9a69fdb6193 Mon Sep 17 00:00:00 2001
0a7b38
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
0a7b38
Date: Sun, 19 Jun 2016 17:12:01 +0200
0a7b38
Subject: [PATCH] api.c: fix potential buffer overflow
0a7b38
MIME-Version: 1.0
0a7b38
Content-Type: text/plain; charset=UTF-8
0a7b38
Content-Transfer-Encoding: 8bit
0a7b38
0a7b38
It is assumed that arguments read from /proc/<pid>/cmdline don't exceed
0a7b38
buf_pname buffer size, which is FILENAME_MAX - 1 characters, but that's
0a7b38
not always the case.
0a7b38
0a7b38
Add check to prevent buffer overflow and discard the excessive part of
0a7b38
an argument.
0a7b38
0a7b38
Signed-off-by: Nikola Forró <nforro@redhat.com>
0a7b38
---
0a7b38
 src/api.c | 6 +++++-
0a7b38
 1 file changed, 5 insertions(+), 1 deletion(-)
0a7b38
0a7b38
diff --git a/src/api.c b/src/api.c
0a7b38
index b40364c..18ce21f 100644
0a7b38
--- a/src/api.c
0a7b38
+++ b/src/api.c
0a7b38
@@ -4055,13 +4055,17 @@ static int cg_get_procname_from_proc_cmdline(pid_t pid,
0a7b38
 
0a7b38
 	while (c != EOF) {
0a7b38
 		c = fgetc(f);
0a7b38
-		if ((c != EOF) && (c != '\0')) {
0a7b38
+		if ((c != EOF) && (c != '\0') && (len < FILENAME_MAX - 1)) {
0a7b38
 			buf_pname[len] = c;
0a7b38
 			len++;
0a7b38
 			continue;
0a7b38
 		}
0a7b38
 		buf_pname[len] = '\0';
0a7b38
 
0a7b38
+		if (len == FILENAME_MAX - 1)
0a7b38
+			while ((c != EOF) && (c != '\0'))
0a7b38
+				c = fgetc(f);
0a7b38
+
0a7b38
 		/*
0a7b38
 		 * The taken process name from /proc/<pid>/status is
0a7b38
 		 * shortened to 15 characters if it is over. So the
0a7b38
-- 
0a7b38
2.7.4
0a7b38