utils: NUL terminate readlinkat buffer

make sure the buffer used by readlinkat is NUL terminated otherwise symlinks targets copied by "tmpcopyup" could be mangled. Closes: containers/crun#719 Signed-off-by: Giuseppe Scrivano <[email protected]>
second-state · Aug 24, 2021 · 5399935 · 5399935
1 parent 6ecf5a5
commit 5399935
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/NEWS b/NEWS
@@ -4,6 +4,7 @@
 - linux: treat pidfd_open failures EINVAL as ESRCH
 - cgroup: add support for setting memory.use_hierarchy on cgroup v1.
 - Makefile.am: fix link error when using directly libcrun.
+- Fix symlink target mangling for tmpcopyup targets.
 
 * crun-0.21
 

diff --git a/src/libcrun/utils.c b/src/libcrun/utils.c
@@ -1906,18 +1906,18 @@ copy_recursive_fd_to_fd (int srcdirfd, int dfd, const char *srcname, const char
           break;
 
         case S_IFLNK:
-          buf_size = st_size + 1;
-          target_buf = xmalloc (buf_size);
-
+          buf_size = st_size;
           do
             {
-              buf_size += 1024;
+              if (target_buf != NULL)
+                buf_size += 1024;
 
-              target_buf = xrealloc (target_buf, buf_size);
+              target_buf = xrealloc (target_buf, buf_size + 1);
 
               size = readlinkat (dirfd (dsrcfd), de->d_name, target_buf, buf_size);
               if (UNLIKELY (size < 0))
                 return crun_make_error (err, errno, "readlink `%s/%s`", srcname, de->d_name);
+              target_buf[size] = '\0';
           } while (size == buf_size);
 
           ret = symlinkat (target_buf, destdirfd, de->d_name);