From 4fbae635adeecb1e0cd783f279d5faae0b4682c3 Mon Sep 17 00:00:00 2001 From: immanuwell Date: Fri, 29 May 2026 21:57:36 +0400 Subject: [PATCH] fix: replace dead len > 2 guard with len != 2 in addSysctl strings.SplitN(s, "=", 2) returns at most 2 elements, so the existing len > 2 check never fires. When a sysctl in containers.conf has no '=' the slice has length 1, and the unconditional access to splitn[1] panics. Change the guard to != 2 so a malformed sysctl returns the descriptive error instead of an index-out-of-bounds panic. Signed-off-by: Immanuel Tikhonov Signed-off-by: immanuwell --- run_linux.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/run_linux.go b/run_linux.go index 3e3a77739cc..1ac6699bee5 100644 --- a/run_linux.go +++ b/run_linux.go @@ -833,7 +833,7 @@ func setupNamespaces(_ *logrus.Logger, g *generate.Generator, namespaceOptions d addSysctl := func(prefixes []string) error { for _, sysctl := range defaultContainerConfig.Sysctls() { splitn := strings.SplitN(sysctl, "=", 2) - if len(splitn) > 2 { + if len(splitn) != 2 { return fmt.Errorf("sysctl %q defined in containers.conf must be formatted name=value", sysctl) } for _, prefix := range prefixes {