From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2206) id 864A9385840C; Tue, 18 Jan 2022 08:02:14 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 864A9385840C Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Siddhesh Poyarekar To: glibc-cvs@sourceware.org Subject: [glibc/siddhesh/realpath-and-getcwd] realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770] X-Act-Checkin: glibc X-Git-Author: Siddhesh Poyarekar X-Git-Refname: refs/heads/siddhesh/realpath-and-getcwd X-Git-Oldrev: 0aca8863e88c11d1f9358eb159a9f7c24ab4130d X-Git-Newrev: 3988c4525072500eddccdb0efe5bd0f7e08d0fdd Message-Id: <20220118080214.864A9385840C@sourceware.org> Date: Tue, 18 Jan 2022 08:02:14 +0000 (GMT) X-BeenThere: glibc-cvs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Glibc-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jan 2022 08:02:14 -0000 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3988c4525072500eddccdb0efe5bd0f7e08d0fdd commit 3988c4525072500eddccdb0efe5bd0f7e08d0fdd Author: Siddhesh Poyarekar Date: Thu Jan 13 11:28:36 2022 +0530 realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770] realpath returns an allocated string when the result exceeds PATH_MAX, which is unexpected when its second argument is not NULL. This results in the second argument (resolved) being uninitialized and also results in a memory leak since the caller expects resolved to be the same as the returned value. Return NULL and set errno to ENAMETOOLONG if the result exceeds PATH_MAX. This fixes [BZ #28770], which is CVE-2021-3998. Signed-off-by: Siddhesh Poyarekar Diff: --- NEWS | 4 ++++ stdlib/Makefile | 1 + stdlib/canonicalize.c | 12 +++++++++-- stdlib/tst-realpath-toolong.c | 48 +++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 63 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index 38802f0673..5c63cef156 100644 --- a/NEWS +++ b/NEWS @@ -163,6 +163,10 @@ Security related changes: CVE-2022-23218: Passing an overlong file name to the svcunix_create legacy function could result in a stack-based buffer overflow. + CVE-2021-3998: Passing a path longer than PATH_MAX to the realpath + function could result in a memory leak and potential access of + uninitialized memory. + The following bugs are resolved with this release: [The release manager will add the list generated by diff --git a/stdlib/Makefile b/stdlib/Makefile index 1e81f98fac..8236741984 100644 --- a/stdlib/Makefile +++ b/stdlib/Makefile @@ -109,6 +109,7 @@ tests := \ tst-random \ tst-random2 \ tst-realpath \ + tst-realpath-toolong \ tst-secure-getenv \ tst-setcontext \ tst-setcontext2 \ diff --git a/stdlib/canonicalize.c b/stdlib/canonicalize.c index f36bdf4c76..732dc7ea46 100644 --- a/stdlib/canonicalize.c +++ b/stdlib/canonicalize.c @@ -400,8 +400,16 @@ realpath_stk (const char *name, char *resolved, error: *dest++ = '\0'; - if (resolved != NULL && dest - rname <= get_path_max ()) - rname = strcpy (resolved, rname); + if (resolved != NULL) + { + if (dest - rname <= get_path_max ()) + rname = strcpy (resolved, rname); + else + { + failed = true; + __set_errno (ENAMETOOLONG); + } + } error_nomem: scratch_buffer_free (&extra_buffer); diff --git a/stdlib/tst-realpath-toolong.c b/stdlib/tst-realpath-toolong.c new file mode 100644 index 0000000000..f10653f05b --- /dev/null +++ b/stdlib/tst-realpath-toolong.c @@ -0,0 +1,48 @@ +/* Verify that realpath returns NULL with ENAMETOOLONG if the result exceeds + NAME_MAX. + Copyright The GNU Toolchain Authors. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define BASENAME "tst-realpath-toolong." + +int +do_test (void) +{ + char *base = support_create_and_chdir_toolong_temp_directory (BASENAME); + + char buf[PATH_MAX + 1]; + const char * const res = realpath (".", buf); + + /* canonicalize.c states that if the real path is >= PATH_MAX, then + realpath returns NULL and sets ENAMETOOLONG. */ + TEST_VERIFY_EXIT (res == NULL && errno == ENAMETOOLONG); + + free (base); + return 0; +} + +#include