[lxc-devel] [lxc/master] btrfs: ensure \0 byte at end

[brauner on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 601 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20190311/f5ea3ecc/attachment.bin>
-------------- next part --------------
From 317e6a8348a40a3c249860921f83f6c1e526095d Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brauner at ubuntu.com>
Date: Mon, 11 Mar 2019 12:47:23 +0100
Subject: [PATCH] btrfs: ensure \0 byte at end

Apparently the name received from the tree walk is not guaranteed to have \0
byte at the end. So let's make sure we append one.
Note that this is only an issue if there are any subvolumes in the container's
rootfs.

Closes 2826.

Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
---
 src/lxc/storage/btrfs.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/lxc/storage/btrfs.c b/src/lxc/storage/btrfs.c
index 06ec7e8c7d..d46ed0a53d 100644
--- a/src/lxc/storage/btrfs.c
+++ b/src/lxc/storage/btrfs.c
@@ -763,7 +763,6 @@ static int btrfs_recursive_destroy(const char *path)
 	int ret, e, i;
 	unsigned long off = 0;
 	u16 name_len;
-	char *name;
 	char *tmppath;
 	u64 dir_id;
 
@@ -835,9 +834,22 @@ static int btrfs_recursive_destroy(const char *path)
 			 * name of the child subvol in question.
 			 */
 			if (sh.objectid != root_id && sh.type == BTRFS_ROOT_BACKREF_KEY) {
+				char *name, *tmp;
+
 				ref = (struct btrfs_root_ref *)(args.buf + off);
 				name_len = btrfs_stack_root_ref_name_len(ref);
-				name = (char *)(ref + 1);
+				tmp = (char *)(ref + 1);
+
+				name = malloc(name_len + 1);
+				if (!name) {
+					ERROR("Out of memory");
+					free_btrfs_tree(tree);
+					free(tmppath);
+					close(fd);
+				}
+
+				memcpy(name, tmp, name_len);
+				name[name_len] = '\0';
 				dir_id = btrfs_stack_root_ref_dirid(ref);
 				tmppath = get_btrfs_subvol_path(fd, sh.offset,
 						dir_id, name, name_len);
@@ -847,12 +859,14 @@ static int btrfs_recursive_destroy(const char *path)
 							name_len, tmppath)) {
 					ERROR("Out of memory");
 					free_btrfs_tree(tree);
+					free(name);
 					free(tmppath);
 					close(fd);
 					return -1;
 				}
 
 				free(tmppath);
+				free(name);
 			}
 
 			off += sh.len;