Commit 85db5535 by Dwight Engen Committed by Serge Hallyn

fix segfault on lxc-create with bad template name

- change get_template_path() to only return NULL or non-NULL since one of the callers was doing a free(-1) which caused the segfault. Handle the NULL template case in the lxcapi_create() caller. - make sure to free(tpath) in the sha1sum_file() failure case Signed-off-by: 's avatarDwight Engen <dwight.engen@oracle.com> Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
parent fe4de9a6
...@@ -713,38 +713,32 @@ static struct bdev *do_bdev_create(struct lxc_container *c, const char *type, ...@@ -713,38 +713,32 @@ static struct bdev *do_bdev_create(struct lxc_container *c, const char *type,
/* /*
* Given the '-t' template option to lxc-create, figure out what to * Given the '-t' template option to lxc-create, figure out what to
* do. If the template is a full executable path, use that. If it * do. If the template is a full executable path, use that. If it
* is something like 'sshd', then return $templatepath/lxc-sshd. If * is something like 'sshd', then return $templatepath/lxc-sshd.
* no template was passed in, return NULL (this is ok). * On success return the template, on error return NULL.
* On error return (char *) -1.
*/ */
char *get_template_path(const char *t) static char *get_template_path(const char *t)
{ {
int ret, len; int ret, len;
char *tpath; char *tpath;
if (!t)
return NULL;
if (t[0] == '/' && access(t, X_OK) == 0) { if (t[0] == '/' && access(t, X_OK) == 0) {
tpath = strdup(t); tpath = strdup(t);
if (!tpath)
return (char *) -1;
return tpath; return tpath;
} }
len = strlen(LXCTEMPLATEDIR) + strlen(t) + strlen("/lxc-") + 1; len = strlen(LXCTEMPLATEDIR) + strlen(t) + strlen("/lxc-") + 1;
tpath = malloc(len); tpath = malloc(len);
if (!tpath) if (!tpath)
return (char *) -1; return NULL;
ret = snprintf(tpath, len, "%s/lxc-%s", LXCTEMPLATEDIR, t); ret = snprintf(tpath, len, "%s/lxc-%s", LXCTEMPLATEDIR, t);
if (ret < 0 || ret >= len) { if (ret < 0 || ret >= len) {
free(tpath); free(tpath);
return (char *) -1; return NULL;
} }
if (access(tpath, X_OK) < 0) { if (access(tpath, X_OK) < 0) {
SYSERROR("bad template: %s\n", t); SYSERROR("bad template: %s\n", t);
free(tpath); free(tpath);
return (char *) -1; return NULL;
} }
return tpath; return tpath;
...@@ -917,20 +911,19 @@ bool prepend_lxc_header(char *path, const char *t, char *const argv[]) ...@@ -917,20 +911,19 @@ bool prepend_lxc_header(char *path, const char *t, char *const argv[])
#if HAVE_LIBGNUTLS #if HAVE_LIBGNUTLS
tpath = get_template_path(t); tpath = get_template_path(t);
if (tpath == (char *) -1) { if (!tpath) {
ERROR("bad template: %s\n", t); ERROR("bad template: %s\n", t);
goto out_free_contents; goto out_free_contents;
} }
if (tpath) { have_tpath = true;
have_tpath = true; ret = sha1sum_file(tpath, md_value);
ret = sha1sum_file(tpath, md_value); if (ret < 0) {
if (ret < 0) { ERROR("Error getting sha1sum of %s", tpath);
ERROR("Error getting sha1sum of %s", tpath);
goto out_free_contents;
}
free(tpath); free(tpath);
goto out_free_contents;
} }
free(tpath);
#endif #endif
process_lock(); process_lock();
...@@ -1006,16 +999,18 @@ static bool lxcapi_create(struct lxc_container *c, const char *t, ...@@ -1006,16 +999,18 @@ static bool lxcapi_create(struct lxc_container *c, const char *t,
{ {
bool bret = false; bool bret = false;
pid_t pid; pid_t pid;
char *tpath; char *tpath = NULL;
int partial_fd; int partial_fd;
if (!c) if (!c)
return false; return false;
tpath = get_template_path(t); if (t) {
if (tpath == (char *) -1) { tpath = get_template_path(t);
ERROR("bad template: %s\n", t); if (!tpath) {
goto out; ERROR("bad template: %s\n", t);
goto out;
}
} }
if (!c->save_config(c, NULL)) { if (!c->save_config(c, NULL)) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment