[LTP] [PATCH] syscalls/ioctl_ns05,6: Fix buffer overflow

Yang Xu xuyang2018.jy@fujitsu.com
Thu Jul 15 03:39:29 CEST 2021


Since pid's max value is 2147483647, the child_namespace maybe not
enough to store "/proc/%s/ns/user" string when using a large pid.
Fix it by improving the length to 30.

Fixes: #847
Reported-by: Marius Hillenbrand <mhillen@linux.ibm.com>
Signed-off-by: Yang Xu <xuyang2018.jy@fujitsu.com>
---
 testcases/kernel/syscalls/ioctl/ioctl_ns05.c | 2 +-
 testcases/kernel/syscalls/ioctl/ioctl_ns06.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/testcases/kernel/syscalls/ioctl/ioctl_ns05.c b/testcases/kernel/syscalls/ioctl/ioctl_ns05.c
index a67ddbe2c..488c48d8e 100644
--- a/testcases/kernel/syscalls/ioctl/ioctl_ns05.c
+++ b/testcases/kernel/syscalls/ioctl/ioctl_ns05.c
@@ -59,7 +59,7 @@ static void run(void)
 	if (pid == -1)
 		tst_brk(TBROK | TERRNO, "ltp_clone failed");
 
-	char child_namespace[20];
+	char child_namespace[30];
 	int my_fd, child_fd, parent_fd;
 
 	sprintf(child_namespace, "/proc/%i/ns/pid", pid);
diff --git a/testcases/kernel/syscalls/ioctl/ioctl_ns06.c b/testcases/kernel/syscalls/ioctl/ioctl_ns06.c
index b6ac80208..77ec04edc 100644
--- a/testcases/kernel/syscalls/ioctl/ioctl_ns06.c
+++ b/testcases/kernel/syscalls/ioctl/ioctl_ns06.c
@@ -51,7 +51,7 @@ static int child(void *arg LTP_ATTRIBUTE_UNUSED)
 
 static void run(void)
 {
-	char child_namespace[20];
+	char child_namespace[30];
 
 	pid_t pid = ltp_clone(CLONE_NEWUSER | SIGCHLD, &child, 0,
 		STACK_SIZE, child_stack);
-- 
2.23.0



More information about the ltp mailing list