From: Christian Brauner <christian.brauner@ubuntu.com>
Date: Mon, 11 Mar 2019 11:47:23 +0000 (+0100)
Subject: btrfs: ensure \0 byte at end
X-Git-Tag: lxc-3.2.0~117^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=317e6a8348a40a3c249860921f83f6c1e526095d;p=thirdparty%2Flxc.git

btrfs: ensure \0 byte at end

Apparently the name received from the tree walk is not guaranteed to have \0
byte at the end. So let's make sure we append one.
Note that this is only an issue if there are any subvolumes in the container's
rootfs.

Closes 2826.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---

diff --git a/src/lxc/storage/btrfs.c b/src/lxc/storage/btrfs.c
index 06ec7e8c7..d46ed0a53 100644
--- a/src/lxc/storage/btrfs.c
+++ b/src/lxc/storage/btrfs.c
@@ -763,7 +763,6 @@ static int btrfs_recursive_destroy(const char *path)
 	int ret, e, i;
 	unsigned long off = 0;
 	u16 name_len;
-	char *name;
 	char *tmppath;
 	u64 dir_id;
 
@@ -835,9 +834,22 @@ static int btrfs_recursive_destroy(const char *path)
 			 * name of the child subvol in question.
 			 */
 			if (sh.objectid != root_id && sh.type == BTRFS_ROOT_BACKREF_KEY) {
+				char *name, *tmp;
+
 				ref = (struct btrfs_root_ref *)(args.buf + off);
 				name_len = btrfs_stack_root_ref_name_len(ref);
-				name = (char *)(ref + 1);
+				tmp = (char *)(ref + 1);
+
+				name = malloc(name_len + 1);
+				if (!name) {
+					ERROR("Out of memory");
+					free_btrfs_tree(tree);
+					free(tmppath);
+					close(fd);
+				}
+
+				memcpy(name, tmp, name_len);
+				name[name_len] = '\0';
 				dir_id = btrfs_stack_root_ref_dirid(ref);
 				tmppath = get_btrfs_subvol_path(fd, sh.offset,
 						dir_id, name, name_len);
@@ -847,12 +859,14 @@ static int btrfs_recursive_destroy(const char *path)
 							name_len, tmppath)) {
 					ERROR("Out of memory");
 					free_btrfs_tree(tree);
+					free(name);
 					free(tmppath);
 					close(fd);
 					return -1;
 				}
 
 				free(tmppath);
+				free(name);
 			}
 
 			off += sh.len;