Unverified Commit 59301023 by Christian Brauner Committed by GitHub

Merge pull request #2585 from 2xsec/bugfix

caps: fix illegal access to array bound
parents d3aba1db b8bcbe9b
...@@ -296,15 +296,13 @@ static long int _real_caps_last_cap(void) ...@@ -296,15 +296,13 @@ static long int _real_caps_last_cap(void)
if (fd >= 0) { if (fd >= 0) {
ssize_t n; ssize_t n;
char *ptr; char *ptr;
char buf[INTTYPE_TO_STRLEN(int)]; char buf[INTTYPE_TO_STRLEN(int)] = {0};
again: again:
n = read(fd, buf, sizeof(buf)); n = read(fd, buf, sizeof(buf) - 1);
if (n < 0 && errno == EINTR) { if (n < 0 && errno == EINTR) {
goto again; goto again;
} else if (n >= 0) { } else if (n >= 0) {
buf[n] = '\0';
errno = 0; errno = 0;
result = strtol(buf, &ptr, 10); result = strtol(buf, &ptr, 10);
if (!ptr || (*ptr != '\0' && *ptr != '\n') || errno != 0) if (!ptr || (*ptr != '\0' && *ptr != '\n') || errno != 0)
......
...@@ -32,9 +32,6 @@ ...@@ -32,9 +32,6 @@
#include "nl.h" #include "nl.h"
#define NLMSG_TAIL(nmsg) \
((struct rtattr *) (((void *) (nmsg)) + NLMSG_ALIGN((nmsg)->nlmsg_len)))
extern size_t nlmsg_len(const struct nlmsg *nlmsg) extern size_t nlmsg_len(const struct nlmsg *nlmsg)
{ {
return nlmsg->nlmsghdr->nlmsg_len - NLMSG_HDRLEN; return nlmsg->nlmsghdr->nlmsg_len - NLMSG_HDRLEN;
......
...@@ -905,8 +905,9 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c ...@@ -905,8 +905,9 @@ static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_c
} }
cur_rule_arch = lxc_seccomp_arch_s390x; cur_rule_arch = lxc_seccomp_arch_s390x;
}
#endif #endif
} else { else {
goto bad_arch; goto bad_arch;
} }
......
...@@ -898,10 +898,10 @@ static char *get_nextpath(char *path, int *offsetp, int fulllen) ...@@ -898,10 +898,10 @@ static char *get_nextpath(char *path, int *offsetp, int fulllen)
if (offset >= fulllen) if (offset >= fulllen)
return NULL; return NULL;
while (path[offset] != '\0' && offset < fulllen) while (offset < fulllen && path[offset] != '\0')
offset++; offset++;
while (path[offset] == '\0' && offset < fulllen) while (offset < fulllen && path[offset] == '\0')
offset++; offset++;
*offsetp = offset; *offsetp = offset;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment