From: Qichao Zhang <njuzhangqichao@gmail.com>
Date: Sun, 20 Mar 2022 01:43:22 +0000 (+0800)
Subject: busybox: fix busybox lock applet pidstr buffer overflow
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=34567750db2c3a84fc9f971189c223e2eefd93b0;p=openwrt%2Fstaging%2Faparcar.git

busybox: fix busybox lock applet pidstr buffer overflow

Kernel setting `/proc/sys/kernel/pid_max` can be set up to 4194304 (7
digits) which will cause buffer overflow in busbox lock patch, this
often happens when running in a rootfs container environment.
This commit enlarges `pidstr` to 12 bytes to ensure a sufficient buffer
for pid number and an additional char '\n'.

Signed-off-by: Qichao Zhang <njuzhangqichao@gmail.com>
---

diff --git a/package/utils/busybox/patches/220-add_lock_util.patch b/package/utils/busybox/patches/220-add_lock_util.patch
index 4e46b74f0e..623121b9fb 100644
--- a/package/utils/busybox/patches/220-add_lock_util.patch
+++ b/package/utils/busybox/patches/220-add_lock_util.patch
@@ -72,9 +72,9 @@
 +
 +static int do_lock(void)
 +{
-+	int pid;
++	pid_t pid;
 +	int flags;
-+	char pidstr[8];
++	char pidstr[12];
 +
 +	if ((fd = open(file, O_RDWR | O_CREAT | O_EXCL, 0700)) < 0) {
 +		if ((fd = open(file, O_RDWR)) < 0) {
@@ -109,7 +109,7 @@
 +		if (!waitonly) {
 +			lseek(fd, 0, SEEK_SET);
 +			ftruncate(fd, 0);
-+			sprintf(pidstr, "%d\n", pid);
++			snprintf(sizeof(pidstr), pidstr, "%d\n", pid);
 +			write(fd, pidstr, strlen(pidstr));
 +			close(fd);
 +		}