]> git.ipfire.org Git - thirdparty/libcgroup.git/commit
api.c: prevent array out-of-bounds access in cgroup_parse_rules_file
authorMikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Wed, 11 Jun 2025 13:50:03 +0000 (16:50 +0300)
committerTom Hromatka <tom.hromatka@oracle.com>
Mon, 16 Jun 2025 14:41:44 +0000 (08:41 -0600)
commit9e7dd5a903d078742b71de69227e944213231fa3
tree6fd4357e2c5fc50ea360069d5e40df43c08e34f7
parentaf758bdbcce15163102833127dbd8e571cc63369
api.c: prevent array out-of-bounds access in cgroup_parse_rules_file

In the function src/api.c/cgroup_parse_rules_file, the condition of loop:

for (i = 0; lst->tail->controllers[i]; i++)
        cgroup_dbg(" %s", lst->tail->controllers[i]);

allows accessing lst->tail->controllers[MAX_MNT_ELEMENTS] if
lst->tail->controllers is full and lacks a terminating NULL.

Add explicit bounds checking (i < MAX_MNT_ELEMENTS) while maintaining
the NULL check. This ensures that there will never be reading past the
array boundaries regardless of its content.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Acked-by: Kamalesh Babulal <kamalesh.babulal@oracle.com>
Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>
(cherry picked from commit ce5749a5ba752d0e273e427fbd2bb68f9f846b64)
src/api.c