public inbox for glibc-bugs@sourceware.org help / color / mirror / Atom feed
From: "john at calva dot com" <sourceware-bugzilla@sourceware.org> To: glibc-bugs@sources.redhat.com Subject: [Bug libc/6654] New: realpath contains off-by-one errors Date: Wed, 18 Jun 2008 13:10:00 -0000 [thread overview] Message-ID: <20080618130922.6654.john@calva.com> (raw) In realpath (stdlib/canonicalize.c) we have: #ifdef PATH_MAX path_max = PATH_MAX; #else path_max = pathconf (name, _PC_PATH_MAX); if (path_max <= 0) path_max = 1024; #endif [...] char *buf = __alloca (path_max); [...] n = __readlink (rpath, buf, path_max); if (n < 0) goto error; buf[n] = '\0'; readlink would be quite happy to fill all path_max bytes of buf, returning path_max as n, then we'll write into buf[path_max] which is one byte beyond the allocated space. Need either +1 on the alloca or -1 on the readlink. -- Summary: realpath contains off-by-one errors Product: glibc Version: unspecified Status: NEW Severity: normal Priority: P2 Component: libc AssignedTo: drepper at redhat dot com ReportedBy: john at calva dot com CC: glibc-bugs at sources dot redhat dot com http://sourceware.org/bugzilla/show_bug.cgi?id=6654 ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
next reply other threads:[~2008-06-18 13:10 UTC|newest] Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2008-06-18 13:10 john at calva dot com [this message] 2008-06-25 13:04 ` [Bug libc/6654] " halesh dot sadashiv at ap dot sony dot com 2008-06-25 13:05 ` halesh dot sadashiv at ap dot sony dot com 2008-06-25 13:05 ` halesh dot sadashiv at ap dot sony dot com 2008-06-25 13:06 ` halesh dot sadashiv at ap dot sony dot com 2008-06-25 13:31 ` halesh dot sadashiv at ap dot sony dot com 2008-06-26 0:02 ` drepper at redhat dot com 2008-06-26 7:51 ` john at calva dot com
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20080618130922.6654.john@calva.com \ --to=sourceware-bugzilla@sourceware.org \ --cc=glibc-bugs@sources.redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).