[Bug libc/28126] New: nftw aborts for paths longer than PATH_MAX

["michael.debertol at gmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28126

            Bug ID: 28126
           Summary: nftw aborts for paths longer than PATH_MAX
           Product: glibc
           Version: 2.33
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: michael.debertol at gmail dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

When process_entry encounters a path longer than data->dirbufsize (which
defaults to PATH_MAX) it tries to reallocate data->dirbuf. This results in an
error.

As far as I can tell this was regressed by
https://sourceware.org/bugzilla/show_bug.cgi?id=26353, which made it so that
data->dirbuf and data->dirstreams initially share a memory allocation.

Here's a simple shell script to create such a long path:

for i in {0..1000}; do mkdir aaaaaaaaaaa && cd aaaaaaaaaaa; done

Here's the output when running nftw with asan:

=================================================================
==19873==ERROR: AddressSanitizer: attempting free on address which was not
malloc()-ed: 0x621000000150 in thread T0
    #0 0x5579dbd81742 in realloc
(/home/michael/devprojects/nftw_test/a.out+0xc7742)
    #1 0x7f0be361e4d5 in process_entry.constprop.0 (/usr/lib/libc.so.6+0xf14d5)
    #2 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #3 0x7f0be361e713 in process_entry.constprop.0 (/usr/lib/libc.so.6+0xf1713)
    #4 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #5 0x7f0be361e713 in process_entry.constprop.0 (/usr/lib/libc.so.6+0xf1713)
    #6 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #7 0x7f0be361e713 in process_entry.constprop.0 (/usr/lib/libc.so.6+0xf1713)
    #8 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #9 0x7f0be361e713 in process_entry.constprop.0 (/usr/lib/libc.so.6+0xf1713)
    #10 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #11 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #12 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #13 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #14 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #15 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #16 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #17 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #18 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #19 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #20 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #21 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #22 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #23 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #24 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #25 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #26 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #27 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #28 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #29 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #30 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #31 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #32 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #33 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #34 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #35 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #36 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #37 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #38 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #39 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #40 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #41 0x7f0be361e713 in process_entry.constprop.0
(/usr/lib/libc.so.6+0xf1713)
    #42 0x7f0be361e98a in ftw_dir (/usr/lib/libc.so.6+0xf198a)
    #43 0x7f0be361ef4b in ftw_startup (/usr/lib/libc.so.6+0xf1f4b)
    #44 0x5579dbdb898b in main
(/home/michael/devprojects/nftw_test/a.out+0xfe98b)
    #45 0x7f0be3554b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
    #46 0x5579dbcda15d in _start
(/home/michael/devprojects/nftw_test/a.out+0x2015d)

0x621000000150 is located 80 bytes inside of 4176-byte region
[0x621000000100,0x621000001150)
allocated by thread T0 here:
    #0 0x5579dbd813b9 in malloc
(/home/michael/devprojects/nftw_test/a.out+0xc73b9)
    #1 0x7f0be361ee38 in ftw_startup (/usr/lib/libc.so.6+0xf1e38)

SUMMARY: AddressSanitizer: bad-free
(/home/michael/devprojects/nftw_test/a.out+0xc7742) in realloc
==19873==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.