From c80c9a70bcad9da9fe56f23ed971d74e4df19a95 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Fri, 21 Aug 2020 09:59:18 +0200 Subject: [PATCH] cgfsng: fix cgroup attach cgroup creation MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit cgroups/cgfsng.c: In function ‘cgroup_attach_leaf.constprop’: cgroups/cgfsng.c:2221:10: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=] 2221 | *slash = '\0'; | ~~~~~~~^~~~~~ cgroups/cgfsng.c:2213:8: note: at offset -13 to object ‘attach_cgroup’ with size 23 declared here 2213 | char attach_cgroup[STRLITERALLEN(".lxc-1000/cgroup.procs") + 1]; | ^~~~~~~~~~~~~ cgroups/cgfsng.c:2229:10: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=] 2229 | *slash = '/'; | ~~~~~~~^~~~~ cgroups/cgfsng.c:2213:8: note: at offset -13 to object ‘attach_cgroup’ with size 23 declared here 2213 | char attach_cgroup[STRLITERALLEN(".lxc-1000/cgroup.procs") + 1]; | ^~~~~~~~~~~~~ cgroups/cgfsng.c:2229:10: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=] 2229 | *slash = '/'; | ~~~~~~~^~~~~ cgroups/cgfsng.c:2213:8: note: at offset -13 to object ‘attach_cgroup’ with size 23 declared here 2213 | char attach_cgroup[STRLITERALLEN(".lxc-1000/cgroup.procs") + 1]; | ^~~~~~~~~~~~~ Link: https://launchpadlibrarian.net/494354168/buildlog_ubuntu-groovy-armhf.lxc_1%3A4.0.4-0ubuntu1_BUILDING.txt.gz Signed-off-by: Christian Brauner --- src/lxc/cgroups/cgfsng.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c index 85afc63af..3ab041e1f 100644 --- a/src/lxc/cgroups/cgfsng.c +++ b/src/lxc/cgroups/cgfsng.c @@ -2216,13 +2216,21 @@ static int cgroup_attach_leaf(const struct lxc_conf *conf, int unified_fd, pid_t do { bool rm = false; - char attach_cgroup[STRLITERALLEN(".lxc-1000/cgroup.procs") + 1]; + char attach_cgroup[STRLITERALLEN(".lxc-/cgroup.procs") + INTTYPE_TO_STRLEN(int) + 1]; char *slash; ret = snprintf(attach_cgroup, sizeof(attach_cgroup), ".lxc-%d/cgroup.procs", idx); if (ret < 0 || (size_t)ret >= sizeof(attach_cgroup)) return ret_errno(EIO); + /* + * This shouldn't really happen but the compiler might complain + * that a short write would cause a buffer overrun. So be on + * the safe side. + */ + if (ret < STRLITERALLEN(".lxc-/cgroup.procs")) + return log_error_errno(-EINVAL, EINVAL, "Unexpected short write would cause buffer-overrun"); + slash = &attach_cgroup[ret] - STRLITERALLEN("/cgroup.procs"); *slash = '\0'; -- 2.47.2