[LTP] [PATCH v3 3/3] numa: Fix out-of-bounds write in gather_node_cpus()

[Pradeep Susarla]

The trailing-comma removal

	cpus[strlen(cpus) - 1] = '\0';

runs unconditionally after the CPU scan. When the node has no online
CPUs (e.g. a memory-only NUMA node, a case write_node_cpusets()
explicitly anticipates), the cpus buffer stays empty, strlen() returns 0
and the unsigned subtraction wraps around, writing a NUL byte out of
bounds. Only strip the comma when at least one CPU was appended.

The bug predates the move from testcases/kernel/lib/numa_cpuset.c and
was spotted during review of the libs/ migration.

Signed-off-by: Pradeep Susarla <pradeep.susarla@gmail.com>
---
 libs/numa/tse_numa.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libs/numa/tse_numa.c b/libs/numa/tse_numa.c
index 3852e0c..5a25227 100644
--- a/libs/numa/tse_numa.c
+++ b/libs/numa/tse_numa.c
@@ -255,8 +255,9 @@ static void gather_node_cpus(char *cpus, long nd)
 			strcat(cpus, buf);
 		}
 	}
-	/* Remove the trailing comma. */
-	cpus[strlen(cpus) - 1] = '\0';
+	/* Remove the trailing comma, if any CPU was found. */
+	if (strlen(cpus) > 0)
+		cpus[strlen(cpus) - 1] = '\0';
 }
 
 void write_node_cpusets(const struct tst_cg_group *cg, long nd)
-- 
2.43.0