crun: check for integer overflow

validate that the stroll returned value can fit into an integer. Closes: containers#1604 Reported-by: Pavel Nekrasov <p.nekrasov@fobos-nt.ru> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
giuseppe · Nov 14, 2024 · ff04a9d · ff04a9d
1 parent 10b2146
commit ff04a9d
Show file tree

Hide file tree

Showing 5 changed files with 36 additions and 8 deletions.
diff --git a/src/create.c b/src/create.c
@@ -80,7 +80,7 @@ parse_opt (int key, char *arg, struct argp_state *state)
       break;
 
     case OPTION_PRESERVE_FDS:
-      crun_context.preserve_fds = strtoul (argp_mandatory_argument (arg, state), NULL, 10);
+      crun_context.preserve_fds = parse_int_or_fail (argp_mandatory_argument (arg, state), "preserve-fds");
       break;
 
     case OPTION_NO_SUBREAPER:
@@ -166,7 +166,7 @@ crun_command_create (struct crun_global_arguments *global_args, int argc, char *
   crun_context.bundle = bundle;
   if (getenv ("LISTEN_FDS"))
     {
-      crun_context.listen_fds = strtoll (getenv ("LISTEN_FDS"), NULL, 10);
+      crun_context.listen_fds = parse_int_or_fail (getenv ("LISTEN_FDS"), "LISTEN_FDS");
       crun_context.preserve_fds += crun_context.listen_fds;
     }
 

diff --git a/src/crun.c b/src/crun.c
@@ -22,6 +22,8 @@
 #include <argp.h>
 #include <string.h>
 #include <libgen.h>
+#include <errno.h>
+#include <limits.h>
 
 #ifdef HAVE_DLOPEN
 #  include <dlfcn.h>
@@ -373,6 +375,24 @@ argp_mandatory_argument (char *arg, struct argp_state *state)
   return state->argv[state->next++];
 }
 
+int
+parse_int_or_fail (const char *str, const char *kind)
+{
+  char *endptr = NULL;
+  long long l;
+
+  errno = 0;
+  l = strtoll (str, &endptr, 10);
+  if (errno != 0)
+    libcrun_fail_with_error (errno, "invalid value for `%s`", kind);
+  if (endptr != NULL && *endptr != '\0')
+    libcrun_fail_with_error (EINVAL, "invalid value for `%s`", kind);
+  if (l < INT_MIN || l > INT_MAX)
+    libcrun_fail_with_error (ERANGE, "invalid value for `%s`", kind);
+
+  return (int) l;
+}
+
 static struct argp argp = { options, parse_opt, args_doc, doc, NULL, NULL, NULL };
 
 int ensure_cloned_binary (void);

diff --git a/src/crun.h b/src/crun.h
@@ -37,6 +37,7 @@ struct crun_global_arguments
 };
 
 char *argp_mandatory_argument (char *arg, struct argp_state *state);
+int parse_int_or_fail (const char *str, const char *kind);
 int init_libcrun_context (libcrun_context_t *con, const char *id, struct crun_global_arguments *glob,
                           libcrun_error_t *err);
 void crun_assert_n_args (int n, int min, int max);

diff --git a/src/exec.c b/src/exec.c
@@ -151,7 +151,7 @@ parse_opt (int key, char *arg, struct argp_state *state)
       break;
 
     case OPTION_PRESERVE_FDS:
-      exec_options.preserve_fds = strtoul (argp_mandatory_argument (arg, state), NULL, 10);
+      exec_options.preserve_fds = parse_int_or_fail (argp_mandatory_argument (arg, state), "preserve-fds");
       break;
 
     case OPTION_CGROUP:
@@ -203,27 +203,34 @@ make_oci_process_user (const char *userspec)
 {
   runtime_spec_schema_config_schema_process_user *u;
   char *endptr = NULL;
+  long long l;
 
   if (userspec == NULL)
     return NULL;
 
   u = xmalloc0 (sizeof (runtime_spec_schema_config_schema_process_user));
   errno = 0;
-  u->uid = strtol (userspec, &endptr, 10);
+  l = strtoll (userspec, &endptr, 10);
   if (errno == ERANGE)
     libcrun_fail_with_error (0, "invalid UID specified");
   if (*endptr == '\0')
     return u;
   if (*endptr != ':')
     libcrun_fail_with_error (0, "invalid USERSPEC specified");
+  if (l < INT_MIN || l > INT_MAX)
+    libcrun_fail_with_error (0, "invalid UID specified");
+
+  u->uid = (int) l;
 
   errno = 0;
-  u->gid = strtol (endptr + 1, &endptr, 10);
+  l = strtoll (endptr + 1, &endptr, 10);
   if (errno == ERANGE)
     libcrun_fail_with_error (0, "invalid GID specified");
+  if (l < INT_MIN || l > INT_MAX)
+    libcrun_fail_with_error (0, "invalid GID specified");
   if (*endptr != '\0')
     libcrun_fail_with_error (0, "invalid USERSPEC specified");
-
+  u->gid = (int) l;
   return u;
 }
 

diff --git a/src/run.c b/src/run.c
@@ -93,7 +93,7 @@ parse_opt (int key, char *arg, struct argp_state *state)
       break;
 
     case OPTION_PRESERVE_FDS:
-      crun_context.preserve_fds = strtoll (argp_mandatory_argument (arg, state), NULL, 10);
+      crun_context.preserve_fds = parse_int_or_fail (argp_mandatory_argument (arg, state), "preserve-fds");
       break;
 
     case OPTION_NO_SUBREAPER:
@@ -177,7 +177,7 @@ crun_command_run (struct crun_global_arguments *global_args, int argc, char **ar
   crun_context.bundle = bundle;
   if (getenv ("LISTEN_FDS"))
     {
-      crun_context.listen_fds = strtoll (getenv ("LISTEN_FDS"), NULL, 10);
+      crun_context.listen_fds = parse_int_or_fail (getenv ("LISTEN_FDS"), "LISTEN_FDS");
       crun_context.preserve_fds += crun_context.listen_fds;
     }