diff options
| author | Daniel Golle | 2026-02-06 11:10:28 +0000 |
|---|---|---|
| committer | Daniel Golle | 2026-02-09 11:37:13 +0000 |
| commit | 014f94cd857df0a66e57d4c205fd28edacf11a4e (patch) | |
| tree | b0971b5780294c4833235ffd656b6c14c57e3d90 | |
| parent | e08cdc8562f55b9ac228a21f3f7605a18c522b81 (diff) | |
procd: jail/cgroups: fix OOB write in cgroups_apply()
Check if any cgroups have been selected and string subtree_control has a
length greater than 0 before reducing its length by 1, preventing to
write outside of the bounds of the array in case no cgroups are
selected.
Fixes: ID: TOB-OWRT-6
Fixes: 16159bb ("jail: parse OCI cgroups resources")
Reported-by: Trail of Bits
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
| -rw-r--r-- | jail/cgroups.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/jail/cgroups.c b/jail/cgroups.c index 2d3dce4..1eb229b 100644 --- a/jail/cgroups.c +++ b/jail/cgroups.c @@ -164,9 +164,12 @@ void cgroups_apply(pid_t pid) if (rdma) strcat(subtree_control, "+rdma "); - /* remove trailing space */ - ent = strchr(subtree_control, '\0') - 1; - *ent = '\0'; + /* remove trailing space (length is > 0) */ + ent = strchr(subtree_control, '\0'); + if (ent > subtree_control) { + ent -= 1; + *ent = '\0'; + } ent = malloc(maxlen); if (!ent) |