tools/cgxget: terminate cgroup names after strncpy()

split_cgroup_name() and parse_opt_args() copy user-supplied names
into struct cgroup->name with strncpy(), but never add a trailing
'\0'. The structs are zeroed when created via cgroup_new_cgroup(""),
yet if we ever reuse an existing object the truncated name would remain
unterminated.

Fix this by explicitly setting cgrp_name[FILENAME_MAX - 1] = '\0' in
split_cgroup_name() and writing '\0' to the last byte of each
destination buffer in parse_opt_args() so the names are always
NUL-terminated.

Signed-off-by: Kamalesh Babulal <kamalesh.babulal@oracle.com>
Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>

diff --git a/src/tools/cgxget.c b/src/tools/cgxget.c
index 4192de59a6f77d5bbafa053eea87210d76836810..0fc9ed10a2520d3ed091a469f7e8962f227ebbdd 100644 (file)
--- a/src/tools/cgxget.c
+++ b/src/tools/cgxget.c
@@ -246,6 +246,7 @@ static int split_cgroup_name(const char * const ctrl_str, char *cgrp_name)
        }
 
        strncpy(cgrp_name, &colon[1], FILENAME_MAX - 1);
+       cgrp_name[FILENAME_MAX - 1] = '\0';
 
        return 0;
 }
@@ -379,6 +380,8 @@ static int parse_opt_args(int argc, char *argv[], struct cgroup **cgrp_list[],
 
                        strncpy((*cgrp_list)[(*cgrp_list_len) - 1]->name, argv[optind],
                                sizeof((*cgrp_list)[(*cgrp_list_len) - 1]->name) - 1);
+                       (*cgrp_list)[(*cgrp_list_len) - 1]->name[
+                               sizeof((*cgrp_list)[(*cgrp_list_len) - 1]->name) - 1] = '\0';
                } else if (cg != NULL && strlen(cg->name) == 0) {
                        /*
                         * this cgroup was created based upon control/value
@@ -386,6 +389,7 @@ static int parse_opt_args(int argc, char *argv[], struct cgroup **cgrp_list[],
                         * populate it with the parameter provided by the user
                         */
                        strncpy(cg->name, argv[optind], sizeof(cg->name) - 1);
+                       cg->name[sizeof(cg->name) - 1] = '\0';
                } else {
                        ret = create_cg(cgrp_list, cgrp_list_len);
                        if (ret)
@@ -398,6 +402,8 @@ static int parse_opt_args(int argc, char *argv[], struct cgroup **cgrp_list[],
 
                        strncpy((*cgrp_list)[(*cgrp_list_len) - 1]->name, argv[optind],
                                sizeof((*cgrp_list)[(*cgrp_list_len) - 1]->name) - 1);
+                       (*cgrp_list)[(*cgrp_list_len) - 1]->name[
+                               sizeof((*cgrp_list)[(*cgrp_list_len) - 1]->name) - 1] = '\0';
                }
 
                optind++;