Re: [Libcg-devel] [PATCH 2/6] api.c: Fix potential buffer overflow

2020-01-23 Thread Tom Hromatka
On 1/22/20 10:09 AM, Nikola Forró wrote: On Thu, 2020-01-16 at 14:46 -0700, Tom Hromatka wrote: I briefly looked through the entire function and it looks like a great candidate for unit testing (except for the readlink() and fopen() lines but that's easily worked around.) Is it? I'm not sure

Re: [Libcg-devel] [PATCH 2/6] api.c: Fix potential buffer overflow

2020-01-22 Thread Nikola Forró
On Thu, 2020-01-16 at 14:46 -0700, Tom Hromatka wrote: > I briefly looked through the entire function and it looks like a > great candidate for unit testing (except for the readlink() and > fopen() lines but that's easily worked around.) Is it? I'm not sure how. Do you have a suggestion? Regards,

Re: [Libcg-devel] [PATCH 2/6] api.c: Fix potential buffer overflow

2020-01-16 Thread Tom Hromatka
On 1/16/20 10:43 AM, Nikola Forró wrote: It is assumed that arguments read from /proc//cmdline don't exceed buf_pname buffer size, which is FILENAME_MAX - 1 characters, but that's not always the case. Add check to prevent buffer overflow and discard the excessive part of an argument. With al