From 6b0551435424b425af850ddeb559045aa10a4d7d Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Fri, 16 Jan 2026 10:57:46 +0100 Subject: [PATCH] seccomp: fix n_plugins calculation and make sure we do not leak resources on errors. Signed-off-by: Giuseppe Scrivano --- src/libcrun/seccomp_notify.c | 13 +++++++++---- tests/tests_libcrun_seccomp_notify.c | 24 +++++++++++++++++++++++- 2 files changed, 32 insertions(+), 5 deletions(-) diff --git a/src/libcrun/seccomp_notify.c b/src/libcrun/seccomp_notify.c index 82936ef0ff..8c1c9430d4 100644 --- a/src/libcrun/seccomp_notify.c +++ b/src/libcrun/seccomp_notify.c @@ -95,13 +95,17 @@ libcrun_load_seccomp_notify_plugins (struct seccomp_notify_context_s **out, cons ctx->sreq = xmalloc (ctx->sizes.seccomp_notif); ctx->sresp = xmalloc (ctx->sizes.seccomp_notif_resp); + if (is_empty_string (plugins)) + return 0; + + b = xstrdup (plugins); + ctx->n_plugins = 1; - for (it = b; it; it = strchr (it, ':')) - ctx->n_plugins++; + for (it = b; *it; it++) + if (*it == ':') + ctx->n_plugins++; ctx->plugins = xmalloc0 (sizeof (struct plugin) * (ctx->n_plugins + 1)); - - b = xstrdup (plugins); for (s = 0, it = strtok_r (b, ":", &saveptr); it; s++, it = strtok_r (NULL, ":", &saveptr)) { run_oci_seccomp_notify_plugin_version_cb version_cb; @@ -254,6 +258,7 @@ libcrun_free_seccomp_notify_plugins (struct seccomp_notify_context_s *ctx, libcr dlclose (ctx->plugins[i].handle); } + free (ctx->plugins); free (ctx); return 0; diff --git a/tests/tests_libcrun_seccomp_notify.c b/tests/tests_libcrun_seccomp_notify.c index 3f24e780ec..b6a23bbbdb 100644 --- a/tests/tests_libcrun_seccomp_notify.c +++ b/tests/tests_libcrun_seccomp_notify.c @@ -114,6 +114,27 @@ test_load_nonexistent_plugin () return 0; } +/* Test load with multiple non-existent plugins to verify cleanup of n_plugins. */ +static int +test_load_multiple_nonexistent_plugins () +{ + libcrun_error_t err = NULL; + struct seccomp_notify_context_s *ctx = NULL; + int ret; + + ret = libcrun_load_seccomp_notify_plugins (&ctx, "/nonexistent/p1.so:/nonexistent/p2.so:/nonexistent/p3.so", NULL, &err); + if (ret >= 0) + { + if (ctx) + libcrun_free_seccomp_notify_plugins (ctx, &err); + crun_error_release (&err); + return -1; + } + + crun_error_release (&err); + return 0; +} + /* Test seccomp_notify_plugins returns error without seccomp support */ static int test_notify_no_seccomp () @@ -167,11 +188,12 @@ int main () { int id = 1; - printf ("1..5\n"); + printf ("1..6\n"); RUN_TEST (test_cleanup_null); RUN_TEST (test_free_null_context); RUN_TEST (test_load_invalid_path); RUN_TEST (test_load_nonexistent_plugin); + RUN_TEST (test_load_multiple_nonexistent_plugins); RUN_TEST (test_notify_no_seccomp); return 0; }