instance: ujail: Fix allocated size for no_new_privs parameter

When the no_new_privs parameter is given, thei size of the  array which
contains the argv pointers is not increased in instance_jail_parse()
which causes a buffer overflow. Fix this by requesting one more entry in
instance_jail_parse() for the allocation.

Fixes: dfd5816bcbef ("instance, ujail: wire no_new_privs (-c) option")
Cc: Etienne CHAMPETIER <champetier.etienne@gmail.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

diff --git a/service/instance.c b/service/instance.c
index b4284e7560545938875e2774df2380b65f380d29..4bb220751915df5a42178ded7075ec405922a079 100644 (file)
--- a/service/instance.c
+++ b/service/instance.c
@@ -829,6 +829,9 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr)
        if (in->seccomp)
                jail->argc += 2;
 
+       if (in->no_new_privs)
+               jail->argc++;
+
        return 1;
 }