diff options
| author | Petr Uzel | 2012-06-14 16:13:02 +0200 |
|---|---|---|
| committer | Karel Zak | 2012-06-15 11:52:10 +0200 |
| commit | bf15afd1e70316231f339764b8701c5daa4faca4 (patch) | |
| tree | 769e7e077a64e190d7d8bc1ba9bf8bd6e1bc6248 /libmount/src/optstr.c | |
| parent | libmount: plug a memory leak in exec_helper() (diff) | |
| download | kernel-qcow2-util-linux-bf15afd1e70316231f339764b8701c5daa4faca4.tar.gz kernel-qcow2-util-linux-bf15afd1e70316231f339764b8701c5daa4faca4.tar.xz kernel-qcow2-util-linux-bf15afd1e70316231f339764b8701c5daa4faca4.zip | |
libmount: fix read before allocated buffer
valgrind --leak-check=full ./sys-utils/mount -t cifs //127.0.0.1/users /mnt/smb -o user=root,password=linux
....
==21359== Invalid read of size 1
==21359== at 0x415AC6: mnt_optstr_remove_option_at (optstr.c:310)
==21359== by 0x416358: mnt_optstr_apply_flags (optstr.c:716)
==21359== by 0x40DFBF: mnt_context_prepare_mount (context_mount.c:86)
==21359== by 0x40EB5A: mnt_context_mount (context_mount.c:782)
==21359== by 0x4058B0: main (mount.c:918)
==21359== Address 0x51cd5bf is 1 bytes before a block of size 10 alloc'd
==21359== at 0x4C297CD: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21359== by 0x4C29957: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21359== by 0x415780: __mnt_optstr_append_option (optstr.c:188)
==21359== by 0x412822: mnt_fs_append_options (fs.c:764)
==21359== by 0x409288: mnt_context_append_options (context.c:733)
==21359== by 0x4053F0: main (mount.c:776)
Signed-off-by: Petr Uzel <petr.uzel@suse.cz>
Diffstat (limited to 'libmount/src/optstr.c')
| -rw-r--r-- | libmount/src/optstr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libmount/src/optstr.c b/libmount/src/optstr.c index c8beadad2..2c9dd5eb1 100644 --- a/libmount/src/optstr.c +++ b/libmount/src/optstr.c @@ -307,7 +307,7 @@ int mnt_optstr_remove_option_at(char **optstr, char *begin, char *end) sz = strlen(end); memmove(begin, end, sz + 1); - if (!*begin && *(begin - 1) == ',') + if (!*begin && (begin > *optstr) && *(begin - 1) == ',') *(begin - 1) = '\0'; return 0; |