Skip to content

L
lxc
Unverified Commit 19c8192f by Christian Brauner
Options

conf: prevent UAF in lxc_clear_limits()

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32532Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 2875de4a
Showing with 6 additions and 3 deletions
src/lxc/conf.c
...@@ -3742,7 +3742,7 @@ int lxc_clear_limits(struct lxc_conf *c, const char *key) ...@@ -3742,7 +3742,7 @@ int lxc_clear_limits(struct lxc_conf *c, const char *key)
else if (strnequal(key, "lxc.prlimit.", STRLITERALLEN("lxc.prlimit."))) else if (strnequal(key, "lxc.prlimit.", STRLITERALLEN("lxc.prlimit.")))
k = key + STRLITERALLEN("lxc.prlimit."); k = key + STRLITERALLEN("lxc.prlimit.");
else else
return -1; return ret_errno(EINVAL);
lxc_list_for_each_safe (it, &c->limits, next) { lxc_list_for_each_safe (it, &c->limits, next) {
struct lxc_limit *lim = it->elem; struct lxc_limit *lim = it->elem;
...@@ -3751,11 +3751,14 @@ int lxc_clear_limits(struct lxc_conf *c, const char *key) ...@@ -3751,11 +3751,14 @@ int lxc_clear_limits(struct lxc_conf *c, const char *key)
continue; continue;
lxc_list_del(it); lxc_list_del(it);
free(lim->resource);
free_disarm(lim->resource);
free(lim); free(lim);
free(it);
} }
if (all)
lxc_list_init(&c->limits);
return 0; return 0;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment