From f8b059fed9494f4357ce3f7d1bb8f329e633bdcf Mon Sep 17 00:00:00 2001 From: Artem Krasovskiy Date: Tue, 28 Jul 2026 19:32:25 +0300 Subject: [PATCH] rootless: fix heap-buffer-overflow in preexec hooks Remove an unnecessary null byte write after copying preexec hook names. The write was performed one byte past the allocated buffer because the filename copy already included the string terminator. Signed-off-by: Artem Krasovskiy --- pkg/rootless/rootless_linux.c | 1 - 1 file changed, 1 deletion(-) diff --git a/pkg/rootless/rootless_linux.c b/pkg/rootless/rootless_linux.c index 1054c32184..fb7b1e529d 100644 --- a/pkg/rootless/rootless_linux.c +++ b/pkg/rootless/rootless_linux.c @@ -447,7 +447,6 @@ do_preexec_hooks_dir (const char *dir, char **argv, int argc) strncpy (buffer + nfiles * (NAME_MAX + 1), de->d_name, NAME_MAX + 1); nfiles++; - buffer[nfiles * (NAME_MAX + 1)] = '\0'; } qsort (buffer, nfiles, NAME_MAX + 1, (int (*)(const void *, const void *)) strcmp);