fix potential out of bounds pointer deref

I noticed that if find_first_wholeword() is called with word at the very
beginning of p, we will deref *(p - 1) to see if it is a word boundary.
Fix by considering p = p0 to be a word boundary.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 4e71fb1525ef280d4bc2b7c186422469111fe598..aaa9f2aebe5616a9b20a671cf2555c7b037e4740 100644 (file)
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -1534,13 +1534,16 @@ static int is_word_sep(char c)
        }
 }
 
-static const char *find_first_wholeword(const char *p, const char *word)
+static const char *find_first_wholeword(const char *p0, const char *word)
 {
+       const char *p = p0;
+
        if (!p)
                return NULL;
 
        while ((p = strstr(p, word)) != NULL) {
-               if (is_word_sep(*(p-1)) && is_word_sep(p[strlen(word)]))
+               if ((p == p0 || is_word_sep(*(p-1))) &&
+                   is_word_sep(p[strlen(word)]))
                        return p;
                p++;
        }