public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/28770] New: Unexpected return value from realpath() for too long results (CVE-2021-3998)
@ 2022-01-12 17:45 siddhesh at sourceware dot org
  2022-01-12 17:46 ` [Bug libc/28770] " siddhesh at sourceware dot org
                   ` (10 more replies)
  0 siblings, 11 replies; 12+ messages in thread
From: siddhesh at sourceware dot org @ 2022-01-12 17:45 UTC (permalink / raw)
  To: glibc-bugs

https://sourceware.org/bugzilla/show_bug.cgi?id=28770

            Bug ID: 28770
           Summary: Unexpected return value from realpath() for too long
                    results (CVE-2021-3998)
           Product: glibc
           Version: 2.35
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: siddhesh at sourceware dot org
          Reporter: siddhesh at sourceware dot org
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

When the resolved_path argument for realpath is non-NULL and the result is
longer than PATH_MAX, the return value is an allocated string instead of
resolved_path, which may result in a memory leak since the caller expects
resolved_path.

Another problem with this behaviour is that if the caller uses resolved_path
instead of the return value from realpath; it may potentially end up using
uninitialized memory.

The expected behaviour in case of result being greater than PATH_MAX is to
return NULL and set ENAMETOOLONG.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

^ permalink raw reply	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2022-01-24 22:49 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-12 17:45 [Bug libc/28770] New: Unexpected return value from realpath() for too long results (CVE-2021-3998) siddhesh at sourceware dot org
2022-01-12 17:46 ` [Bug libc/28770] " siddhesh at sourceware dot org
2022-01-13  5:44 ` sam at gentoo dot org
2022-01-13  6:10 ` siddhesh at sourceware dot org
2022-01-13 11:59 ` fweimer at redhat dot com
2022-01-15 15:41 ` aurelien at aurel32 dot net
2022-01-17  9:08 ` pgowda.cve at gmail dot com
2022-01-21 17:45 ` siddhesh at sourceware dot org
2022-01-24 16:11 ` cvs-commit at gcc dot gnu.org
2022-01-24 16:15 ` cvs-commit at gcc dot gnu.org
2022-01-24 22:46 ` cvs-commit at gcc dot gnu.org
2022-01-24 22:49 ` cvs-commit at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).