From: Alejandro Colomar <alx@kernel.org>
Date: Thu, 11 Jan 2024 18:12:24 +0000 (+0100)
Subject: lib/idmapping.c: write_mapping(): Fixx off-by-one bug
X-Git-Tag: 4.15.0-rc1~40
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=effdb147868af6df3e645d82e2d7c3544f44a786;p=thirdparty%2Fshadow.git

lib/idmapping.c: write_mapping(): Fixx off-by-one bug

Link: <https://github.com/shadow-maint/shadow/commit/673c2a6f9aa6c69588f4c1be08589b8d3475a520#r136830993>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
---

diff --git a/lib/idmapping.c b/lib/idmapping.c
index 7454c3d81..c861beb65 100644
--- a/lib/idmapping.c
+++ b/lib/idmapping.c
@@ -192,7 +192,7 @@ void write_mapping(int proc_dir_fd, int ranges, const struct map_range *mappings
 	}
 #endif
 
-	bufsize = ranges * ((ULONG_DIGITS + 1) * 3);
+	bufsize = (ULONG_DIGITS + 1) * 3 * ranges + 1;
 	pos = buf = XMALLOC(bufsize, char);
 	end = buf + bufsize;