btrfs: ensure \0 byte at end

[mirror_lxc.git] / src / lxc / storage / btrfs.c

diff --git a/src/lxc/storage/btrfs.c b/src/lxc/storage/btrfs.c
index 06ec7e8c7dfd7f1ecc28e891d209edfdd90f8e32..d46ed0a53d49231f479560e5227493d4061d67d8 100644 (file)
--- a/src/lxc/storage/btrfs.c
+++ b/src/lxc/storage/btrfs.c
@@ -763,7 +763,6 @@ static int btrfs_recursive_destroy(const char *path)
        int ret, e, i;
        unsigned long off = 0;
        u16 name_len;
-       char *name;
        char *tmppath;
        u64 dir_id;
 
@@ -835,9 +834,22 @@ static int btrfs_recursive_destroy(const char *path)
                         * name of the child subvol in question.
                         */
                        if (sh.objectid != root_id && sh.type == BTRFS_ROOT_BACKREF_KEY) {
+                               char *name, *tmp;
+
                                ref = (struct btrfs_root_ref *)(args.buf + off);
                                name_len = btrfs_stack_root_ref_name_len(ref);
-                               name = (char *)(ref + 1);
+                               tmp = (char *)(ref + 1);
+
+                               name = malloc(name_len + 1);
+                               if (!name) {
+                                       ERROR("Out of memory");
+                                       free_btrfs_tree(tree);
+                                       free(tmppath);
+                                       close(fd);
+                               }
+
+                               memcpy(name, tmp, name_len);
+                               name[name_len] = '\0';
                                dir_id = btrfs_stack_root_ref_dirid(ref);
                                tmppath = get_btrfs_subvol_path(fd, sh.offset,
                                                dir_id, name, name_len);
@@ -847,12 +859,14 @@ static int btrfs_recursive_destroy(const char *path)
                                                        name_len, tmppath)) {
                                        ERROR("Out of memory");
                                        free_btrfs_tree(tree);
+                                       free(name);
                                        free(tmppath);
                                        close(fd);
                                        return -1;
                                }
 
                                free(tmppath);
+                               free(name);
                        }
 
                        off += sh.len;