fix: malloc size off-by-one in cgroup_process_v2_mnt

need to allocate the length of both strings, plus the space added in
the sprintf, plus the terminating null byte.

Signed-off-by: Adriaan Schmidt <adriaan.schmidt@siemens.com>
Reviewed-by: Kamalesh Babulal <kamalesh.babulal@oracle.com>
Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>

diff --git a/src/api.c b/src/api.c
index 5428cc343c1ff4dd72749b714f8eb801abf2b95d..e24805cda7e6326769db9bf375c5ac2b783bca4b 100644 (file)
--- a/src/api.c
+++ b/src/api.c
@@ -1272,7 +1272,7 @@ STATIC int cgroup_process_v2_mnt(struct mntent *ent, int *mnt_tbl_idx)
         * wish to read/modify.  Add it to our cg_mount_table so that it can be manipulated
         * like other "normal" controllers
         */
-       controllers = malloc(strlen(ret_c) + strlen(CGROUP_FILE_PREFIX) + 1);
+       controllers = malloc(strlen(ret_c) + strlen(CGROUP_FILE_PREFIX) + 2);
        if (!controllers) {
                ret = ECGOTHER;
                goto out;