conf: prevent UAF in lxc_clear_limits()

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32532Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: prevent UAF in lxc_clear_limits()
19c8192f · Christian Brauner · 2875de4a · 19c8192f
Unverified Commit 19c8192f authored Mar 26, 2021 by Christian Brauner
Hide whitespace changes
Inline Side-by-side

Showing with 6 additions and 3 deletions

conf.c src/lxc/conf.c +6 -3

No files found.
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3742,7 +3742,7 @@ int lxc_clear_limits(struct lxc_conf *c, const char *key)
 	else if (strnequal(key, "lxc.prlimit.", STRLITERALLEN("lxc.prlimit.")))
 		k = key + STRLITERALLEN("lxc.prlimit.");
 	else
-		return -1;
+		return ret_errno(EINVAL);

 	lxc_list_for_each_safe (it, &c->limits, next) {
 		struct lxc_limit *lim = it->elem;
@@ -3751,11 +3751,14 @@ int lxc_clear_limits(struct lxc_conf *c, const char *key)
 			continue;

 		lxc_list_del(it);
-		free(lim->resource);
+
+		free_disarm(lim->resource);
 		free(lim);
-		free(it);
 	}

+	if (all)
+		lxc_list_init(&c->limits);
+
 	return 0;
 }