Skip to content

L
lxc
Unverified Commit bccf738c by Christian Brauner
Options

cgroups: fix potential nullderef

The child_path variable is initialized very late in the function so jumping to the on_error label would cause a nullderef. With the cleanup macros we can simplify this function to simply do direct returns and avoid that whole issue. Closes #2935. Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com>
parent def2d52b
Showing with 10 additions and 14 deletions
src/lxc/cgroups/cgfsng.c
...@@ -519,10 +519,11 @@ on_error: ...@@ -519,10 +519,11 @@ on_error:
/* Copy contents of parent(@path)/@file to @path/@file */ /* Copy contents of parent(@path)/@file to @path/@file */
static bool copy_parent_file(char *path, char *file) static bool copy_parent_file(char *path, char *file)
{ {
__do_free char *child_path = NULL, *parent_path = NULL, *value = NULL;
int ret; int ret;
char *fpath, *lastslash, oldv; char oldv;
int len = 0; int len = 0;
char *value = NULL; char *lastslash = NULL;
lastslash = strrchr(path, '/'); lastslash = strrchr(path, '/');
if (!lastslash) { if (!lastslash) {
...@@ -531,30 +532,25 @@ static bool copy_parent_file(char *path, char *file) ...@@ -531,30 +532,25 @@ static bool copy_parent_file(char *path, char *file)
} }
oldv = *lastslash; oldv = *lastslash;
*lastslash = '\0'; *lastslash = '\0';
fpath = must_make_path(path, file, NULL); parent_path = must_make_path(path, file, NULL);
len = lxc_read_from_file(fpath, NULL, 0); len = lxc_read_from_file(parent_path, NULL, 0);
if (len <= 0) if (len <= 0)
goto on_error; goto on_error;
value = must_realloc(NULL, len + 1); value = must_realloc(NULL, len + 1);
ret = lxc_read_from_file(fpath, value, len); ret = lxc_read_from_file(parent_path, value, len);
if (ret != len) if (ret != len)
goto on_error; goto on_error;
free(fpath);
*lastslash = oldv; *lastslash = oldv;
fpath = must_make_path(path, file, NULL); child_path = must_make_path(path, file, NULL);
ret = lxc_write_to_file(fpath, value, len, false, 0666); ret = lxc_write_to_file(child_path, value, len, false, 0666);
if (ret < 0) if (ret < 0)
SYSERROR("Failed to write \"%s\" to file \"%s\"", value, fpath); SYSERROR("Failed to write \"%s\" to file \"%s\"", value, child_path);
free(fpath);
free(value);
return ret >= 0; return ret >= 0;
on_error: on_error:
SYSERROR("Failed to read file \"%s\"", fpath); SYSERROR("Failed to read file \"%s\"", child_path);
free(fpath);
free(value);
return false; return false;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment