Commit a495e1fd by Serge Hallyn

Merge pull request #932 from n-eiling/criu-log-fix

fix possible buffer overflow
parents 24d6495f 72a30576
...@@ -126,8 +126,8 @@ static void exec_criu(struct criu_opts *opts) ...@@ -126,8 +126,8 @@ static void exec_criu(struct criu_opts *opts)
int netnr = 0; int netnr = 0;
struct lxc_list *it; struct lxc_list *it;
char buf[4096], *pos, tty_info[32]; char buf[4096], tty_info[32];
size_t pos;
/* If we are currently in a cgroup /foo/bar, and the container is in a /* If we are currently in a cgroup /foo/bar, and the container is in a
* cgroup /lxc/foo, lxcfs will give us an ENOENT if some task in the * cgroup /lxc/foo, lxcfs will give us an ENOENT if some task in the
* container has an open fd that points to one of the cgroup files * container has an open fd that points to one of the cgroup files
...@@ -363,10 +363,14 @@ static void exec_criu(struct criu_opts *opts) ...@@ -363,10 +363,14 @@ static void exec_criu(struct criu_opts *opts)
argv[argc] = NULL; argv[argc] = NULL;
buf[0] = 0; buf[0] = 0;
pos = buf; pos = 0;
for (i = 0; argv[i]; i++) { for (i = 0; argv[i]; i++) {
pos = strncat(buf, argv[i], buf + sizeof(buf) - pos); ret = snprintf(buf + pos, sizeof(buf) - pos, "%s ", argv[i]);
pos = strncat(buf, " ", buf + sizeof(buf) - pos); if (ret < 0 || ret >= sizeof(buf) - pos)
goto err;
else
pos += ret;
} }
INFO("execing: %s", buf); INFO("execing: %s", buf);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment