[lxc-devel] [lxc/master] overlay: fix out-of-bounds copy

[3XX0 on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 354 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20171211/7ae7ebcd/attachment.bin>
-------------- next part --------------
From fe3485479f6df2587bf9d7c4ab090ac9de534b19 Mon Sep 17 00:00:00 2001
From: Jonathan Calmels <jcalmels at nvidia.com>
Date: Mon, 11 Dec 2017 14:49:57 -0800
Subject: [PATCH] overlay: fix out-of-bounds copy

Signed-off-by: Jonathan Calmels <jcalmels at nvidia.com>
---
 src/lxc/storage/overlay.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/lxc/storage/overlay.c b/src/lxc/storage/overlay.c
index ac7636192..f8632dcf1 100644
--- a/src/lxc/storage/overlay.c
+++ b/src/lxc/storage/overlay.c
@@ -410,15 +410,12 @@ int ovl_create(struct lxc_storage *bdev, const char *dest, const char *n,
 		return -1;
 	}
 
-	delta = malloc(len + 1);
+	delta = strdup(dest);
 	if (!delta) {
 		ERROR("Failed to allocate memory");
 		return -1;
 	}
-
-	memcpy(delta, dest, len);
 	memcpy(delta + len - 6, "delta0", sizeof("delta0") - 1);
-	delta[len + sizeof("delta0")] = '\0';
 
 	ret = mkdir_p(delta, 0755);
 	if (ret < 0) {