From 0c4826e31cf1faa88add1a4906a0617788b35b33 Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brauner@ubuntu.com>
Date: Mon, 10 Dec 2018 14:22:04 +0100
Subject: [PATCH] btrfs: fix get_btrfs_subvol_path()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---
 src/lxc/storage/btrfs.c | 46 ++++++++++++++++++++++++++++-------------
 src/lxc/storage/btrfs.h |  2 +-
 2 files changed, 33 insertions(+), 15 deletions(-)

diff --git a/src/lxc/storage/btrfs.c b/src/lxc/storage/btrfs.c
index d2727b6dc..012132d19 100644
--- a/src/lxc/storage/btrfs.c
+++ b/src/lxc/storage/btrfs.c
@@ -41,6 +41,10 @@
 #include "storage.h"
 #include "utils.h"
 
+#ifndef HAVE_STRLCAT
+#include "include/strlcat.h"
+#endif
+
 #ifndef HAVE_STRLCPY
 #include "include/strlcpy.h"
 #endif
@@ -58,11 +62,11 @@ extern char *dir_new_path(char *src, const char *oldname, const char *name,
  * simply return a.
  */
 char *get_btrfs_subvol_path(int fd, u64 dir_id, u64 objid, char *name,
-			    int name_len)
+			    u16 name_len)
 {
 	struct btrfs_ioctl_ino_lookup_args args;
-	int ret, e;
-	size_t len;
+	int ret;
+	size_t len, retlen;
 	char *retpath;
 
 	memset(&args, 0, sizeof(args));
@@ -70,17 +74,16 @@ char *get_btrfs_subvol_path(int fd, u64 dir_id, u64 objid, char *name,
 	args.objectid = objid;
 
 	ret = ioctl(fd, BTRFS_IOC_INO_LOOKUP, &args);
-	e = errno;
 	if (ret) {
-		ERROR("Failed to lookup path for %llu %llu %s - %s\n",
-				 (unsigned long long) dir_id,
-				 (unsigned long long) objid,
-				 name, strerror(e));
+		SYSERROR("Failed to lookup path for %llu %llu %s",
+		         (unsigned long long) dir_id,
+		         (unsigned long long) objid,
+		         name);
 		return NULL;
 	} else
-		INFO("Got path for %llu %llu - %s\n",
-			(unsigned long long) objid, (unsigned long long) dir_id,
-			name);
+		INFO("Got path for %llu %llu - %s",
+		     (unsigned long long) objid, (unsigned long long) dir_id,
+		     name);
 
 	if (args.name[0]) {
 		/*
@@ -91,18 +94,33 @@ char *get_btrfs_subvol_path(int fd, u64 dir_id, u64 objid, char *name,
 		retpath = malloc(len);
 		if (!retpath)
 			return NULL;
+
 		(void)strlcpy(retpath, args.name, len);
-		strncat(retpath, "/", 1);
-		strncat(retpath, name, name_len);
+		(void)strlcat(retpath, "/", len);
+
+		retlen = strlcat(retpath, name, len);
+		if (retlen >= len) {
+			ERROR("Failed to append name - %s", name);
+			free(retpath);
+			return NULL;
+		}
 	} else {
 		/* we're at the root of ref_tree */
 		len = name_len + 1;
 		retpath = malloc(len);
 		if (!retpath)
 			return NULL;
+
 		*retpath = '\0';
-		strncat(retpath, name, name_len);
+
+		retlen = strlcat(retpath, name, len);
+		if (retlen >= len) {
+			ERROR("Failed to append name - %s", name);
+			free(retpath);
+			return NULL;
+		}
 	}
+
 	return retpath;
 }
 
diff --git a/src/lxc/storage/btrfs.h b/src/lxc/storage/btrfs.h
index 142f7abbd..ec34d09e8 100644
--- a/src/lxc/storage/btrfs.h
+++ b/src/lxc/storage/btrfs.h
@@ -396,7 +396,7 @@ extern int btrfs_mount(struct lxc_storage *bdev);
 extern int btrfs_umount(struct lxc_storage *bdev);
 
 extern char *get_btrfs_subvol_path(int fd, u64 dir_id, u64 objid, char *name,
-                                  int name_len);
+				   u16 name_len);
 extern int btrfs_list_get_path_rootid(int fd, u64 *treeid);
 extern bool is_btrfs_fs(const char *path);
 extern int is_btrfs_subvol(const char *path);
-- 
2.47.2