summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2012-11-19 16:36:38 +0100
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2012-11-19 17:13:37 +0100
commitac97e2c559f5d386a332aba4a24bf9930cdb1c51 (patch)
tree9341e3b927a6fec99e3f29aa6cfbdb544e83fec6
parentc040936be2a4c77e9465cffae47d77d5ec14fb49 (diff)
core/load-fragment: fix (potential) bad memory access
strncmp() could be used with size bigger then the size of the string, because MAX was used instead of MIN. If failing, print just the offending mount flag.
-rw-r--r--src/core/load-fragment.c17
1 files changed, 12 insertions, 5 deletions
diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index 01f94844a6..6933e1a21e 100644
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -1101,15 +1101,22 @@ int config_parse_exec_mount_flags(
assert(rvalue);
assert(data);
- FOREACH_WORD_QUOTED(w, l, rvalue, state) {
- if (strncmp(w, "shared", MAX(l, 6U)) == 0)
+ FOREACH_WORD_SEPARATOR(w, l, rvalue, ", ", state) {
+ char _cleanup_free_ *t;
+
+ t = strndup(w, l);
+ if (!t)
+ return -ENOMEM;
+
+ if (streq(t, "shared"))
flags |= MS_SHARED;
- else if (strncmp(w, "slave", MAX(l, 5U)) == 0)
+ else if (streq(t, "slave"))
flags |= MS_SLAVE;
- else if (strncmp(w, "private", MAX(l, 7U)) == 0)
+ else if (streq(w, "private"))
flags |= MS_PRIVATE;
else {
- log_error("[%s:%u] Failed to parse mount flags, ignoring: %s", filename, line, rvalue);
+ log_error("[%s:%u] Failed to parse mount flag %s, ignoring: %s",
+ filename, line, t, rvalue);
return 0;
}
}