[lxc-devel] [lxc/master] Fix buffer overflow in do_start()

[GreatFruitOmsk on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 387 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20160331/eb22b035/attachment.bin>
-------------- next part --------------
From a91cde21992e365dc5563c9431c444cfcf23cae0 Mon Sep 17 00:00:00 2001
From: Aleksandr Mezin <mezin.alexander at gmail.com>
Date: Thu, 31 Mar 2016 16:46:03 +0600
Subject: [PATCH] Fix buffer overflow in do_start()

Signed-off-by: Aleksandr Mezin <mezin.alexander at gmail.com>
---
 src/lxc/start.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lxc/start.c b/src/lxc/start.c
index 6d2c7b5..5be0077 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -790,7 +790,7 @@ static int do_start(void *data)
 	}
 	#endif
 
-	ret = sprintf(path, "%s/dev/null", handler->conf->rootfs.mount);
+	ret = snprintf(path, sizeof(path), "%s/dev/null", handler->conf->rootfs.mount);
 	if (ret < 0 || ret >= sizeof(path)) {
 		SYSERROR("sprintf'd too many chars");
 		goto out_warn_father;