From 22c3ab6b8dae78e19cc15ed1313886b611ea2f1b Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Sun, 15 Mar 2026 02:43:05 +0000 Subject: [PATCH] proc: Fix potential buffer overflow in parse_threads When parse_threads() is called with a pre-allocated array (e.g., when re-parsing threads), it must ensure that the number of threads found in /proc does not exceed the size of the provided buffer. Add a check to prevent out-of-bounds access if the thread count increases unexpectedly. Signed-off-by: Andrei Vagin --- criu/proc_parse.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/criu/proc_parse.c b/criu/proc_parse.c index 6070e8773..288c59347 100644 --- a/criu/proc_parse.c +++ b/criu/proc_parse.c @@ -2570,6 +2570,12 @@ int parse_threads(int pid, struct pid **_t, int *_n) } t = tmp; t[nr - 1].ns[0].virt = -1; + } else { + if (nr > *_n) { + pr_err("Too many threads for %d (%d > %d)\n", pid, nr, *_n); + closedir(dir); + return -1; + } } t[nr - 1].real = atoi(de->d_name); t[nr - 1].state = TASK_THREAD;