Merge pull request #2516 from 2xsec/bugfix

src/lxc/caps.c

@@ -310,7 +310,7 @@ int lxc_caps_init(void)
 	return 0;
 }
 
-static int _real_caps_last_cap(void)
+static long int _real_caps_last_cap(void)
 {
 	int fd, result = -1;
 
@@ -354,10 +354,13 @@ static int _real_caps_last_cap(void)
 
 int lxc_caps_last_cap(void)
 {
-	static int last_cap = -1;
+	static long int last_cap = -1;
 
-	if (last_cap < 0)
+	if (last_cap < 0) {
 		last_cap = _real_caps_last_cap();
+		if (last_cap < 0 || last_cap > INT_MAX)
+			last_cap = -1;
+	}
 
 	return last_cap;
 }

src/lxc/cgroups/cgfsng.c

@@ -397,7 +397,7 @@ static bool cg_legacy_filter_and_set_cpus(char *path, bool am_initialized)
 
 	/* Get maximum number of cpus found in possible cpuset. */
 	maxposs = get_max_cpus(posscpus);
-	if (maxposs < 0)
+	if (maxposs < 0 || maxposs >= INT_MAX - 1)
 		goto on_error;
 
 	if (!file_exists(__ISOL_CPUS)) {
@@ -442,7 +442,7 @@ static bool cg_legacy_filter_and_set_cpus(char *path, bool am_initialized)
 
 	/* Get maximum number of cpus found in isolated cpuset. */
 	maxisol = get_max_cpus(isolcpus);
-	if (maxisol < 0)
+	if (maxisol < 0 || maxisol >= INT_MAX - 1)
 		goto on_error;
 
 	if (maxposs < maxisol)

src/lxc/pam/pam_cgfs.c

@@ -1806,7 +1806,7 @@ static bool cg_filter_and_set_cpus(char *path, bool am_initialized)
 
 	/* Get maximum number of cpus found in possible cpuset. */
 	maxposs = cg_get_max_cpus(posscpus);
-	if (maxposs < 0)
+	if (maxposs < 0 || maxposs >= INT_MAX - 1)
 		goto on_error;
 
 	if (!file_exists(__ISOL_CPUS)) {
@@ -1856,7 +1856,7 @@ static bool cg_filter_and_set_cpus(char *path, bool am_initialized)
 
 	/* Get maximum number of cpus found in isolated cpuset. */
 	maxisol = cg_get_max_cpus(isolcpus);
-	if (maxisol < 0)
+	if (maxisol < 0 || maxisol >= INT_MAX - 1)
 		goto on_error;
 
 	if (maxposs < maxisol)

src/tests/containertests.c

@@ -149,8 +149,15 @@ int main(int argc, char *argv[])
 		goto out;
 	}
 
-	if (lxc_container_put(c) != 0) {
+	ret = lxc_container_put(c);
+	if (ret < 0) {
+		fprintf(stderr, "%d: c is invalid pointer\n", __LINE__);
+		ret = 1;
+		goto out;
+	}
+	else if (ret == 1) {
 		fprintf(stderr, "%d: c was freed on non-final put\n", __LINE__);
+		c = NULL;
 		goto out;
 	}
 
@@ -257,8 +264,8 @@ out:
 	if (c) {
 		c->stop(c);
 		destroy_busybox();
+		lxc_container_put(c);
 	}
 
-	lxc_container_put(c);
 	exit(ret);
 }