Comment 2 for bug 1011477

Revision history for this message
Björn Jacke (bjoern-j3e) wrote : Re: cron-apt buffer overflow with high pid numbers

the following patch on liblockfile's lockfile.c fixes the issue:

--- a/lockfile.c
+++ b/lockfile.c
@@ -175,7 +175,7 @@ int lockfile_create(const char *lockfile, int retries, int flags)
        struct stat st, st1;
        char *tmplock;
        char sysname[256];
- char buf[8];
+ char buf[sizeof("-18446744073709551616")+2];
        char *p;
        int sleeptime = 0;
        int statfailed = 0;

the fix was done by Stefan Metzmacher.

you should also have a look at this part of the code which looks like it can cause problems, too:

        if ((tmplock = (char *)malloc(strlen(lockfile)+32+1)) == NULL)
                return L_ERROR;
        strcpy(tmplock, lockfile);
        if ((p = strrchr(tmplock, '/')) == NULL)
                p = tmplock;
        else
                p++;
        sprintf(p, ".lk%05d%x%s",
                (int)getpid(), (int)time(NULL) & 15, sysname);