Skip to content

L
lxc
Unverified Commit 3cc0d428 by Christian Brauner Committed by GitHub
Options

Merge pull request #2419 from 2xsec/bugfix

secure coding: strcat => strncat
parents 13413325 25aced9f
Showing with 132 additions and 53 deletions
src/lxc/cgroups/cgfsng.c
......@@ -58,6 +58,14 @@
#include "storage/storage.h"
#include "utils.h"
#ifndef HAVE_STRLCPY
#include "include/strlcpy.h"
#endif
#ifndef HAVE_STRLCAT
#include "include/strlcat.h"
#endif
lxc_log_define(lxc_cgfsng, lxc);
static void free_string_list(char **clist)
......@@ -1195,19 +1203,23 @@ static bool cg_unified_create_cgroup(struct hierarchy *h, char *cgname)
* some thinking.
*/
for (it = h->controllers; it && *it; it++) {
full_len += strlen(*it) + 2;
add_controllers = must_realloc(add_controllers, full_len + 1);
if (h->controllers[0] == *it)
add_controllers[0] = '\0';
strcat(add_controllers, "+");
strcat(add_controllers, *it);
if ((it + 1) && *(it + 1))
strcat(add_controllers, " ");
full_len += strlen(*it) + 2;
add_controllers = must_realloc(add_controllers, full_len + 1);
if (h->controllers[0] == *it)
add_controllers[0] = '\0';
(void)strlcat(add_controllers, "+", full_len + 1);
(void)strlcat(add_controllers, *it, full_len + 1);
if ((it + 1) && *(it + 1))
(void)strlcat(add_controllers, " ", full_len + 1);
}
parts = lxc_string_split(cgname, '/');
if (!parts)
goto on_error;
parts_len = lxc_array_len((void **)parts);
if (parts_len > 0)
parts_len--;
......@@ -1301,9 +1313,10 @@ static inline bool cgfsng_create(struct cgroup_ops *ops,
ERROR("Failed expanding cgroup name pattern");
return false;
}
len = strlen(tmp) + 5; /* leave room for -NNN\0 */
container_cgroup = must_alloc(len);
strcpy(container_cgroup, tmp);
(void)strlcpy(container_cgroup, tmp, len);
free(tmp);
offset = container_cgroup + len - 5;
......@@ -1942,7 +1955,7 @@ static int __cg_unified_attach(const struct hierarchy *h, const char *name,
if (ret < 0 && errno != EEXIST)
goto on_error;
strcat(full_path, "/cgroup.procs");
(void)strlcat(full_path, "/cgroup.procs", len + 1);
ret = lxc_write_to_file(full_path, pidstr, len, false, 0666);
if (ret == 0)
goto on_success;
......@@ -2022,7 +2035,8 @@ static int cgfsng_get(struct cgroup_ops *ops, const char *filename, char *value,
controller_len = strlen(filename);
controller = alloca(controller_len + 1);
strcpy(controller, filename);
(void)strlcpy(controller, filename, controller_len + 1);
p = strchr(controller, '.');
if (p)
*p = '\0';
......@@ -2059,7 +2073,8 @@ static int cgfsng_set(struct cgroup_ops *ops, const char *filename,
controller_len = strlen(filename);
controller = alloca(controller_len + 1);
strcpy(controller, filename);
(void)strlcpy(controller, filename, controller_len + 1);
p = strchr(controller, '.');
if (p)
*p = '\0';
......@@ -2176,7 +2191,8 @@ static int cg_legacy_set_data(struct cgroup_ops *ops, const char *filename,
len = strlen(filename);
controller = alloca(len + 1);
strcpy(controller, filename);
(void)strlcpy(controller, filename, len + 1);
p = strchr(controller, '.');
if (p)
*p = '\0';
......
src/lxc/conf.c
......@@ -76,6 +76,10 @@
#include <sys/personality.h>
#endif
#ifndef HAVE_STRLCAT
#include "include/strlcat.h"
#endif
#if IS_BIONIC
#include <../include/lxcmntent.h>
#else
......@@ -841,6 +845,7 @@ static int lxc_setup_dev_symlinks(const struct lxc_rootfs *rootfs)
static bool append_ttyname(char **pp, char *name)
{
char *p;
size_t size;
if (!*pp) {
*pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
......@@ -851,13 +856,14 @@ static bool append_ttyname(char **pp, char *name)
return true;
}
p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
size = strlen(*pp) + strlen(name) + 2;
p = realloc(*pp, size);
if (!p)
return false;
*pp = p;
strcat(p, " ");
strcat(p, name);
(void)strlcat(p, " ", size);
(void)strlcat(p, name, size);
return true;
}
......@@ -1788,7 +1794,7 @@ static int lxc_setup_console(const struct lxc_rootfs *rootfs,
return lxc_setup_ttydir_console(rootfs, console, ttydir);
}
static void parse_mntopt(char *opt, unsigned long *flags, char **data)
static void parse_mntopt(char *opt, unsigned long *flags, char **data, size_t size)
{
struct mount_opt *mo;
......@@ -1806,14 +1812,16 @@ static void parse_mntopt(char *opt, unsigned long *flags, char **data)
}
if (strlen(*data))
strcat(*data, ",");
strcat(*data, opt);
(void)strlcat(*data, ",", size);
(void)strlcat(*data, opt, size);
}
int parse_mntopts(const char *mntopts, unsigned long *mntflags, char **mntdata)
{
char *data, *p, *s;
char *saveptr = NULL;
size_t size;
*mntdata = NULL;
*mntflags = 0L;
......@@ -1825,7 +1833,8 @@ int parse_mntopts(const char *mntopts, unsigned long *mntflags, char **mntdata)
if (!s)
return -1;
data = malloc(strlen(s) + 1);
size = strlen(s) + 1;
data = malloc(size);
if (!data) {
free(s);
return -1;
......@@ -1833,7 +1842,7 @@ int parse_mntopts(const char *mntopts, unsigned long *mntflags, char **mntdata)
*data = 0;
for (; (p = strtok_r(s, ",", &saveptr)); s = NULL)
parse_mntopt(p, mntflags, &data);
parse_mntopt(p, mntflags, &data, size);
if (*data)
*mntdata = data;
......
src/lxc/confile.c
......@@ -69,6 +69,10 @@
#include "include/strlcpy.h"
#endif
#ifndef HAVE_STRLCAT
#include "include/strlcat.h"
#endif
lxc_log_define(lxc_confile, lxc);
#define lxc_config_define(name) \
......@@ -2060,10 +2064,11 @@ int append_unexp_config_line(const char *line, struct lxc_conf *conf)
conf->unexpanded_config = tmp;
conf->unexpanded_alloced += 1024;
}
strcat(conf->unexpanded_config, line);
(void)strlcat(conf->unexpanded_config, line, conf->unexpanded_alloced);
conf->unexpanded_len += linelen;
if (line[linelen - 1] != '\n') {
strcat(conf->unexpanded_config, "\n");
(void)strlcat(conf->unexpanded_config, "\n", conf->unexpanded_alloced);
conf->unexpanded_len++;
}
......
src/lxc/pam/pam_cgfs.c
......@@ -63,6 +63,10 @@
#include "include/strlcpy.h"
#endif
#ifndef HAVE_STRLCAT
#include "include/strlcat.h"
#endif
#define pam_cgfs_debug_stream(stream, format, ...) \
do { \
fprintf(stream, "%s: %d: %s: " format, __FILE__, __LINE__, \
......@@ -1617,6 +1621,7 @@ static char *string_join(const char *sep, const char **parts, bool use_as_prefix
char **p;
size_t sep_len = strlen(sep);
size_t result_len = use_as_prefix * sep_len;
size_t buf_len;
if (!parts)
return NULL;
......@@ -1625,17 +1630,18 @@ static char *string_join(const char *sep, const char **parts, bool use_as_prefix
for (p = (char **)parts; *p; p++)
result_len += (p > (char **)parts) * sep_len + strlen(*p);
result = calloc(result_len + 1, sizeof(char));
buf_len = result_len + 1;
result = calloc(buf_len, sizeof(char));
if (!result)
return NULL;
if (use_as_prefix)
(void)strlcpy(result, sep, (result_len + 1) * sizeof(char));
(void)strlcpy(result, sep, buf_len * sizeof(char));
for (p = (char **)parts; *p; p++) {
if (p > (char **)parts)
strcat(result, sep);
strcat(result, *p);
(void)strlcat(result, sep, buf_len * sizeof(char));
(void)strlcat(result, *p, buf_len * sizeof(char));
}
return result;
......
src/lxc/pam/utils.c
......@@ -33,6 +33,10 @@
#include "utils.h"
#ifndef HAVE_STRLCAT
#include "include/strlcat.h"
#endif
bool file_exists(const char *f)
{
struct stat statbuf;
......@@ -69,6 +73,7 @@ char *must_make_path(const char *first, ...)
va_list args;
char *cur, *dest;
size_t full_len = strlen(first);
size_t buf_len;
dest = must_copy_string(first);
......@@ -77,10 +82,13 @@ char *must_make_path(const char *first, ...)
full_len += strlen(cur);
if (cur[0] != '/')
full_len++;
dest = must_realloc(dest, full_len + 1);
buf_len = full_len + 1;
dest = must_realloc(dest, buf_len);
if (cur[0] != '/')
strcat(dest, "/");
strcat(dest, cur);
(void)strlcat(dest, "/", buf_len);
(void)strlcat(dest, cur, buf_len);
}
va_end(args);
......
src/lxc/storage/btrfs.c
......@@ -63,7 +63,7 @@ char *get_btrfs_subvol_path(int fd, u64 dir_id, u64 objid, char *name,
{
struct btrfs_ioctl_ino_lookup_args args;
int ret, e;
size_t len;
size_t len, retlen;
char *retpath;
memset(&args, 0, sizeof(args));
......@@ -92,18 +92,33 @@ char *get_btrfs_subvol_path(int fd, u64 dir_id, u64 objid, char *name,
retpath = malloc(len);
if (!retpath)
return NULL;
(void)strlcpy(retpath, args.name, len);
(void)strlcat(retpath, "/", 1);
(void)strlcat(retpath, name, name_len);
(void)strlcat(retpath, "/", len);
retlen = strlcat(retpath, name, len);
if (retlen >= len) {
ERROR("Failed to append name - %s\n", name);
free(retpath);
return NULL;
}
} else {
/* we're at the root of ref_tree */
len = name_len + 1;
retpath = malloc(len);
if (!retpath)
return NULL;
*retpath = '\0';
(void)strlcat(retpath, name, name_len);
retlen = strlcat(retpath, name, len);
if (retlen >= len) {
ERROR("Failed to append name - %s\n", name);
free(retpath);
return NULL;
}
}
return retpath;
}
......
src/lxc/tools/tool_utils.c
......@@ -52,6 +52,10 @@
#include "include/strlcpy.h"
#endif
#ifndef HAVE_STRLCAT
#include "include/strlcat.h"
#endif
int lxc_fill_elevated_privileges(char *flaglist, int *flags)
{
char *token, *saveptr = NULL;
......@@ -503,22 +507,24 @@ char *lxc_string_join(const char *sep, const char **parts, bool use_as_prefix)
char **p;
size_t sep_len = strlen(sep);
size_t result_len = use_as_prefix * sep_len;
size_t buf_len;
/* calculate new string length */
for (p = (char **)parts; *p; p++)
result_len += (p > (char **)parts) * sep_len + strlen(*p);
result = calloc(result_len + 1, 1);
buf_len = result_len + 1;
result = calloc(buf_len, 1);
if (!result)
return NULL;
if (use_as_prefix)
(void)strlcpy(result, sep, result_len + 1);
(void)strlcpy(result, sep, buf_len);
for (p = (char **)parts; *p; p++) {
if (p > (char **)parts)
strcat(result, sep);
strcat(result, *p);
(void)strlcat(result, sep, buf_len);
(void)strlcat(result, *p, buf_len);
}
return result;
......@@ -1071,6 +1077,7 @@ char *must_make_path(const char *first, ...)
va_list args;
char *cur, *dest;
size_t full_len = strlen(first);
size_t buf_len;
dest = must_copy_string(first);
......@@ -1079,10 +1086,13 @@ char *must_make_path(const char *first, ...)
full_len += strlen(cur);
if (cur[0] != '/')
full_len++;
dest = must_realloc(dest, full_len + 1);
buf_len = full_len + 1;
dest = must_realloc(dest, buf_len);
if (cur[0] != '/')
strcat(dest, "/");
strcat(dest, cur);
(void)strlcat(dest, "/", buf_len);
(void)strlcat(dest, cur, buf_len);
}
va_end(args);
......
src/lxc/utils.c
......@@ -55,6 +55,10 @@
#include "include/strlcpy.h"
#endif
#ifndef HAVE_STRLCAT
#include "include/strlcat.h"
#endif
#ifndef O_PATH
#define O_PATH 010000000
#endif
......@@ -635,22 +639,24 @@ char *lxc_string_join(const char *sep, const char **parts, bool use_as_prefix)
char **p;
size_t sep_len = strlen(sep);
size_t result_len = use_as_prefix * sep_len;
size_t buf_len;
/* calculate new string length */
for (p = (char **)parts; *p; p++)
result_len += (p > (char **)parts) * sep_len + strlen(*p);
result = calloc(result_len + 1, 1);
buf_len = result_len + 1;
result = calloc(buf_len, 1);
if (!result)
return NULL;
if (use_as_prefix)
(void)strlcpy(result, sep, result_len + 1);
(void)strlcpy(result, sep, buf_len);
for (p = (char **)parts; *p; p++) {
if (p > (char **)parts)
strcat(result, sep);
strcat(result, *p);
(void)strlcat(result, sep, buf_len);
(void)strlcat(result, *p, buf_len);
}
return result;
......@@ -2310,6 +2316,7 @@ char *must_make_path(const char *first, ...)
va_list args;
char *cur, *dest;
size_t full_len = strlen(first);
size_t buf_len;
dest = must_copy_string(first);
......@@ -2318,10 +2325,13 @@ char *must_make_path(const char *first, ...)
full_len += strlen(cur);
if (cur[0] != '/')
full_len++;
dest = must_realloc(dest, full_len + 1);
buf_len = full_len + 1;
dest = must_realloc(dest, buf_len);
if (cur[0] != '/')
strcat(dest, "/");
strcat(dest, cur);
(void)strlcat(dest, "/", buf_len);
(void)strlcat(dest, cur, buf_len);
}
va_end(args);
......@@ -2334,21 +2344,21 @@ char *must_append_path(char *first, ...)
size_t full_len;
va_list args;
char *dest = first;
size_t buf_len;
full_len = strlen(first);
va_start(args, first);
while ((cur = va_arg(args, char *)) != NULL) {
full_len += strlen(cur);
if (cur[0] != '/')
full_len++;
dest = must_realloc(dest, full_len + 1);
buf_len = full_len + 1;
dest = must_realloc(dest, buf_len);
if (cur[0] != '/')
strcat(dest, "/");
strcat(dest, cur);
(void)strlcat(dest, "/", buf_len);
(void)strlcat(dest, cur, buf_len);
}
va_end(args);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment