drakenclimber / libcgroup
56%
main: 56%

LAST BUILD BRANCH: change-email
DEFAULT BRANCH: main
Repo Added
Files 39
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH test
branch: test
CHANGE BRANCH
x

coverage: 56.078% (-0.03%) from 56.108%
23312294051

push

github

drakenclimber 
config: pass NULL when probing systemd default cgroup

ASan reported following global-buffer-overflow:

READ of size 1 at 0x7f50dc6b3e9f thread T0
    #0 0x... in cg_concat_path <src>/src/api.c:1769
    #1 0x... in cg_build_path_locked <src>/src/api.c:1889
    #2 0x... in cg_build_path <src>/src/api.c:1910
    #3 0x.. in systemd_default_cgroup_exists <src>/src/config.c:2258
    #4 0x.. in cgroup_set_default_systemd_cgroup <src>/src/config.c:2306
    #5 0x... in main <src>/src/tools/cgdelete.c:193
    #6 0x... in __libc_start_call_main (/lib64/libc.so.6+0x2a60f)
    #7 0x... in __libc_start_main_alias_2 (/lib64/libc.so.6+0x2a6bf)
    #8 0x... in _start (/usr/local/bin/cgdelete+0x402384)

0x... sits one byte to the left of the empty string literal '.LC3' that
systemd_default_cgroup_exists() handed to cg_build_path(). Passing an
empty suffix made cg_concat_path() evaluate suf[-1] while it decided
whether to append a trailing slash, triggering the ASan
global-buffer-overflow.

Fix by passing NULL, instead of "" (empty string) so cg_build_path()
skips the suffix concatenation entirely. The resulting canonical paths
are unchanged, but cgdelete (and any other caller) now runs without
trampling the adjacent literal.

Fixes: https://github.com/libcgroup/libcgroup/issues/526
Signed-off-by: Kamalesh Babulal <kamalesh.babulal@oracle.com>
Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>

1 of 1 new or added line in 1 file covered. (100.0%)

3 existing lines in 1 file now uncovered.

5628 of 10036 relevant lines covered (56.08%)

607.81 hits per line

Relevant lines Covered
10036 RELEVANT LINES 5628 COVERED LINES
607.81 HITS PER LINE
Source Files on test

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
23312294051 test config: pass NULL when probing systemd default cgroup ASan reported following global-buffer-overflow: READ of size 1 at 0x7f50dc6b3e9f thread T0 #0 0x... in cg_concat_path <src>/src/api.c:1769 #1 0x... in cg_build_path_locked <src>/src/a... push drakenclimber github
56.08
23311009133 test tools/cgxget: free temporary conversions on failure paths AddressSanitizer reported an 8-byte leak when convert_cgroups() aborted: Direct leak of 8 byte(s) in 1 object(s) allocated from: #0 0x... in __interceptor_malloc #1 co... push drakenclimber github
56.11
23309518013 test api: leave room for NUL in cgroup_get_procs() Commit 4a851a569689 ("api: Fix unsafe call to strncat in cgroup_get_procs() and cgroup_get_threads()") tightened several strncat() callers, but the code building the procs/threads paths still used the... push drakenclimber github
56.2
23308118686 test ftests/999: tidy config writes and stress paths Systemd.write_config_with_pid() now writes the temporary config inside a context manager so the file descriptor is always closed. The 999-stress helper switched to os.path.join(), which automaticall... push drakenclimber github
56.17
23307563353 test ftests/077: drop unused global and fix list sorting flake8 reported: tests/ftests/077-pybindings-cgroup_get_procs.py:52:5: F824 is unused: name is never assigned in scope The test already appends to the module-level list, so we do not reassign... push drakenclimber github
56.24
22957196270 test tests/ftests: speed up is_output_same() line compare loop is_output_same() used to call expected_out.splitlines() on every iteration and index into the freshly built list. Switching to enumerate(zip(out_lines, exp_lines)) lets us split both strin... push drakenclimber github
56.21
22956879275 test src/config: free namespace table on success and failure The per-thread namespace table (cg_namespace_table[]) is populated by config_order_namespace_table() / config_validate_namespaces() under cg_mount_table_lock and then consumed by cg_build_pa... push drakenclimber github
56.21
22781467195 test Testing out a fix from codex • Fix Details - Freed the lexer-owned ID strings whenever cgroup_dictionary_create or cgroup_dictionary_add fail, matching the leak reported in issue #518 where parse errors left duplicated tokens allocated... push drakenclimber github
56.17
22781323480 test Testing out a fix from codex Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> push drakenclimber github
56.21
20820343591 test src/api.c: potential null ptr deref in cg_get_cgroups_from_proc_cgroups In function cg_get_cgroups_from_proc_cgroups there is an allocation of memory by calling malloc(buff_len). Result of this allocation is not checked, and in case of OOM it'll ... push drakenclimber github
56.07
See All Builds (1028)