[lxc-devel] [lxc/master] confile: fix append_unexp_config_line()

[brauner on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 407 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20181017/42a5c07e/attachment.bin>
-------------- next part --------------
From 2bacce6ab323842a5912086af2360736eb14d3c1 Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brauner at ubuntu.com>
Date: Wed, 17 Oct 2018 15:16:27 +0200
Subject: [PATCH] confile: fix append_unexp_config_line()

Reported-by: 2xsec dh48.jeong at samsung.com
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
---
 src/lxc/confile.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index af7be1501..686ed14c0 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -2038,10 +2038,12 @@ static int set_config_console_size(const char *key, const char *value,
 
 int append_unexp_config_line(const char *line, struct lxc_conf *conf)
 {
-	size_t len = conf->unexpanded_len, linelen = strlen(line);
+	size_t linelen;
+	size_t len = conf->unexpanded_len;
 
 	update_hwaddr(line);
 
+	linelen = strlen(line);
 	while (conf->unexpanded_alloced <= len + linelen + 2) {
 		char *tmp = realloc(conf->unexpanded_config,
 				    conf->unexpanded_alloced + 1024);
@@ -2050,16 +2052,18 @@ int append_unexp_config_line(const char *line, struct lxc_conf *conf)
 
 		if (!conf->unexpanded_config)
 			*tmp = '\0';
+
 		conf->unexpanded_config = tmp;
 		conf->unexpanded_alloced += 1024;
 	}
 
-	(void)strlcat(conf->unexpanded_config, line, conf->unexpanded_alloced);
+	memcpy(conf->unexpanded_config + conf->unexpanded_len, line, linelen);
 	conf->unexpanded_len += linelen;
 	if (line[linelen - 1] != '\n') {
-		(void)strlcat(conf->unexpanded_config, "\n", conf->unexpanded_alloced);
+		memcpy(conf->unexpanded_config + conf->unexpanded_len, "\n", 1);
 		conf->unexpanded_len++;
 	}
+	conf->unexpanded_config[conf->unexpanded_len] = '\0';
 
 	return 0;
 }