From a252a6f9706465fd7a542a8e2039266f30cfd9d1 Mon Sep 17 00:00:00 2001
From: William Brown <william@blackhats.net.au>
Date: Apr 07 2020 23:34:40 +0000
Subject: Ticket 51014 - slapi_pal.c possible static buffer overflow


Bug Description: Due to an incorrect use of a buffer size,
static analysis in suse detected a possible overflow in
slapi pal. However, it requires root permissions to exploit
anything, and thus is not a security issues.

Fix Description: Change the buffer we read the cgroup into
to be maxpathlen size.

https://pagure.io/389-ds-base/issue/51014

Author: William Brown <william@blackhats.net.au>

Review by: ???

---

diff --git a/ldap/servers/slapd/slapi_pal.c b/ldap/servers/slapd/slapi_pal.c
index c6b0dda..f658d46 100644
--- a/ldap/servers/slapd/slapi_pal.c
+++ b/ldap/servers/slapd/slapi_pal.c
@@ -126,7 +126,7 @@ _spal_dir_exist(char *path)
 static char *
 _spal_cgroupv2_path() {
     FILE *f;
-    char s[256] = {0};
+    char s[MAXPATHLEN + 1] = {0};
     char *res = NULL;
     /* We discover our path by looking at /proc/self/cgroup */
     f = fopen("/proc/self/cgroup", "r");