From 317e6a8348a40a3c249860921f83f6c1e526095d Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Mon, 11 Mar 2019 12:47:23 +0100 Subject: [PATCH] btrfs: ensure \0 byte at end Apparently the name received from the tree walk is not guaranteed to have \0 byte at the end. So let's make sure we append one. Note that this is only an issue if there are any subvolumes in the container's rootfs. Closes 2826. Signed-off-by: Christian Brauner --- src/lxc/storage/btrfs.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/src/lxc/storage/btrfs.c b/src/lxc/storage/btrfs.c index 06ec7e8c7..d46ed0a53 100644 --- a/src/lxc/storage/btrfs.c +++ b/src/lxc/storage/btrfs.c @@ -763,7 +763,6 @@ static int btrfs_recursive_destroy(const char *path) int ret, e, i; unsigned long off = 0; u16 name_len; - char *name; char *tmppath; u64 dir_id; @@ -835,9 +834,22 @@ static int btrfs_recursive_destroy(const char *path) * name of the child subvol in question. */ if (sh.objectid != root_id && sh.type == BTRFS_ROOT_BACKREF_KEY) { + char *name, *tmp; + ref = (struct btrfs_root_ref *)(args.buf + off); name_len = btrfs_stack_root_ref_name_len(ref); - name = (char *)(ref + 1); + tmp = (char *)(ref + 1); + + name = malloc(name_len + 1); + if (!name) { + ERROR("Out of memory"); + free_btrfs_tree(tree); + free(tmppath); + close(fd); + } + + memcpy(name, tmp, name_len); + name[name_len] = '\0'; dir_id = btrfs_stack_root_ref_dirid(ref); tmppath = get_btrfs_subvol_path(fd, sh.offset, dir_id, name, name_len); @@ -847,12 +859,14 @@ static int btrfs_recursive_destroy(const char *path) name_len, tmppath)) { ERROR("Out of memory"); free_btrfs_tree(tree); + free(name); free(tmppath); close(fd); return -1; } free(tmppath); + free(name); } off += sh.len; -- 2.47.2