From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
To: libc-alpha@sourceware.org
Subject: Re: [PATCH 3/4] stdlib: Fix arithmetic overflows in realpath [BZ #26592]
Date: Tue, 27 Oct 2020 09:59:38 -0300 [thread overview]
Message-ID: <7d646a11-ab86-17b4-2fc6-74d29d1f8d14@linaro.org> (raw)
In-Reply-To: <20200910151915.1982465-3-adhemerval.zanella@linaro.org>
Ping.
On 10/09/2020 12:19, Adhemerval Zanella wrote:
> The realpath uses an end-of-array pointer 'rpath_limit', and makes
> invalid (overflowing) comparisons against it to catch overflow:
>
> 117 /* Find end of path component. */
> 118 if (dest + (end-start) >= rpath_limit)
>
> I could not see a easy way to stress this issue since it rely on how
> the input argument is layout in memory along with a large filename
> name that trigger the overflow comparison. However, the fix is
> simple enough where it simple reorganize arithmetic in the comparison.
>
> Checked on x86_64-linux-gnu and i686-linux-gnu.
> ---
> stdlib/canonicalize.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/stdlib/canonicalize.c b/stdlib/canonicalize.c
> index 6798ed8963..44a25a9a59 100644
> --- a/stdlib/canonicalize.c
> +++ b/stdlib/canonicalize.c
> @@ -136,7 +136,7 @@ __realpath (const char *name, char *resolved)
> if (dest[-1] != '/')
> *dest++ = '/';
>
> - if (dest + (end - start) >= rpath_limit)
> + if (end - start >= rpath_limit - dest)
> {
> ptrdiff_t dest_offset = dest - rpath;
> char *new_rpath;
>
next prev parent reply other threads:[~2020-10-27 12:59 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-10 15:19 [PATCH 1/4] Sync canonicalize with gnulib [BZ #10635] Adhemerval Zanella
2020-09-10 15:19 ` [PATCH v3 2/4 v2] stdlib: Use fixed buffer size for realpath [BZ #26241] Adhemerval Zanella
2020-10-27 12:59 ` Adhemerval Zanella
2020-09-10 15:19 ` [PATCH 3/4] stdlib: Fix arithmetic overflows in realpath [BZ #26592] Adhemerval Zanella
2020-10-27 12:59 ` Adhemerval Zanella [this message]
2020-09-10 15:19 ` [PATCH 4/4] stdlib: Remove lstat usage from realpath [BZ #24970] Adhemerval Zanella
2020-10-27 12:59 ` Adhemerval Zanella
2020-10-27 12:59 ` [PATCH 1/4] Sync canonicalize with gnulib [BZ #10635] Adhemerval Zanella
2020-10-27 13:15 ` Andreas Schwab
2020-10-27 13:22 ` Adhemerval Zanella
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7d646a11-ab86-17b4-2fc6-74d29d1f8d14@linaro.org \
--to=adhemerval.zanella@linaro.org \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).