[lxc-devel] [PATCH] Fix strlen on non-null terminated buffer strlen() becomes strnlen()

[Christian Brauner]

On Mon, Sep 07, 2015 at 07:50:10PM +0000, Serge Hallyn wrote:
> Quoting Christian Brauner (christianvanbrauner at gmail.com):
> > Sorry, forget it, that doesn't make sense...
> > 
> > On Mon, Sep 07, 2015 at 08:38:51PM +0200, Christian Brauner wrote:
> > > Signed-off-by: Christian Brauner <christianvanbrauner at gmail.com>
> > > ---
> > >  src/lxc/lxccontainer.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
> > > index 932d658..ae9f895 100644
> > > --- a/src/lxc/lxccontainer.c
> > > +++ b/src/lxc/lxccontainer.c
> > > @@ -2074,7 +2074,7 @@ static bool mod_rdep(struct lxc_container *c0, struct lxc_container *c, bool inc
> > >  			 * a multiple of a pagesize. Hence, we'll use memmem(). */
> > >  			if ((del = memmem(buf, fbuf.st_size, newpath, len))) {
> > >  				/* remove container entry */
> > > -				memmove(del, del + len, strlen(del) - len + 1);
> > > +				memmove(del, del + len, strnlen(del, fbuf.st_size) - len + 1);
> 
> strnlen can still go off the end here.  I think you want something like:
> 
> 				if (del != buf + fbuf.st_size - len) {
> 					size_t difflen = fbuf.st_size - (del-buf);
> 					memmove(del, del + len, strnlen(del, difflen) - len);
> 					del[len] = '\0';
> 				}
Thanks, what about:
                                if ((del = memmem(buf, fbuf.st_size, newpath, len))) {
	                        	size_t dellen = fbuf.st_size - len;
	                        	memmove(del, del + len, dellen - len);
	                        }

What would you prefer?
I don't know if we want to append '\0' or leave that to the caller?

> 
> 
> > >  
> > >  				munmap(buf, fbuf.st_size);
> > >  
> > > -- 
> > > 2.5.1
> > > 
> 
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150907/4944b786/attachment.sig>