libmount: fix read before allocated buffer

valgrind --leak-check=full ./sys-utils/mount -t cifs //127.0.0.1/users /mnt/smb -o user=root,password=linux
....
==21359== Invalid read of size 1
==21359==    at 0x415AC6: mnt_optstr_remove_option_at (optstr.c:310)
==21359==    by 0x416358: mnt_optstr_apply_flags (optstr.c:716)
==21359==    by 0x40DFBF: mnt_context_prepare_mount (context_mount.c:86)
==21359==    by 0x40EB5A: mnt_context_mount (context_mount.c:782)
==21359==    by 0x4058B0: main (mount.c:918)
==21359==  Address 0x51cd5bf is 1 bytes before a block of size 10 alloc'd
==21359==    at 0x4C297CD: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21359==    by 0x4C29957: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21359==    by 0x415780: __mnt_optstr_append_option (optstr.c:188)
==21359==    by 0x412822: mnt_fs_append_options (fs.c:764)
==21359==    by 0x409288: mnt_context_append_options (context.c:733)
==21359==    by 0x4053F0: main (mount.c:776)

Signed-off-by: Petr Uzel <petr.uzel@suse.cz>

diff --git a/libmount/src/optstr.c b/libmount/src/optstr.c
index c8beadad2ac79e8916031862972025c9012389b1..2c9dd5eb1f88fe88c4dc89361ac866c6398a1195 100644 (file)
--- a/libmount/src/optstr.c
+++ b/libmount/src/optstr.c
@@ -307,7 +307,7 @@ int mnt_optstr_remove_option_at(char **optstr, char *begin, char *end)
        sz = strlen(end);
 
        memmove(begin, end, sz + 1);
-       if (!*begin && *(begin - 1) == ',')
+       if (!*begin && (begin > *optstr) && *(begin - 1) == ',')
                *(begin - 1) = '\0';
 
        return 0;