From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oo1-xc36.google.com (mail-oo1-xc36.google.com [IPv6:2607:f8b0:4864:20::c36]) by sourceware.org (Postfix) with ESMTPS id 0D185385AC20 for ; Tue, 18 Jan 2022 19:43:22 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 0D185385AC20 Received: by mail-oo1-xc36.google.com with SMTP id f4-20020a4ac484000000b002e3e221d769so44957ooq.1 for ; Tue, 18 Jan 2022 11:43:22 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=8CDPmN4/gmOuOf4NmjP3u/2m8qUKwT9E2SXfs3q8YRA=; b=Tznkdwh8trGcZr48ileYXrnyKC0J2OxMDCxS9N696epYGrR9U4TF4TRYY3C5VtwUn+ ThRr/8+TKETAckKWlhl/nGfNTY3m3YZGg9/xoe001hjI3MkDlUFtKNPRlxYQUfh5ifAA 6raerNAG8C39npwxxlKf3S53tN0m8QjxEQ8gT4QM6R4X5BL1EqYtwBWiFxuiBv2Tbpp4 DwzvR1Hry9/f2B1B3Lcg2XwSOAjkwZem+F/pcPPy5OeoTRYif8t6VZFz/ZVy5qQpgDnJ vW8Vl///iYIZOgpcacCa43cKI4UuSs5uWLfseJ42DiD/PU1GBU0QTXcF1mhMjZo6ywqQ DmOQ== X-Gm-Message-State: AOAM530zP9ic1X7XlUIq0bBStdjBWVZa0DQi1UdqNozbRGjSJeixepto i4HNeLzXgDFx6JooBG/0JC4nxw== X-Google-Smtp-Source: ABdhPJz2LSBSj9fXVu757Pj711P3k/yIaKQAC8zfXb7QOAHR8Lc+KYiVgr48dhmZSaYELkS/M0SAtA== X-Received: by 2002:a4a:98a6:: with SMTP id a35mr19835242ooj.56.1642535001356; Tue, 18 Jan 2022 11:43:21 -0800 (PST) Received: from ?IPV6:2804:431:c7cb:989a:419b:3fe6:8885:ab23? ([2804:431:c7cb:989a:419b:3fe6:8885:ab23]) by smtp.gmail.com with ESMTPSA id y21sm1284040oiv.53.2022.01.18.11.43.20 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 18 Jan 2022 11:43:21 -0800 (PST) Message-ID: <8f6ce1bd-974a-72d3-d27f-316c2b6102f0@linaro.org> Date: Tue, 18 Jan 2022 16:43:19 -0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.5.0 Subject: Re: [PATCH 2/3] realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770] Content-Language: en-US To: Siddhesh Poyarekar , libc-alpha@sourceware.org Cc: fweimer@redhat.com References: <20220118090728.1825487-1-siddhesh@sourceware.org> <20220118090728.1825487-3-siddhesh@sourceware.org> From: Adhemerval Zanella In-Reply-To: <20220118090728.1825487-3-siddhesh@sourceware.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-12.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_SHORT, NICE_REPLY_A, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jan 2022 19:43:26 -0000 On 18/01/2022 06:07, Siddhesh Poyarekar wrote: > realpath returns an allocated string when the result exceeds PATH_MAX, > which is unexpected when its second argument is not NULL. This results > in the second argument (resolved) being uninitialized and also results > in a memory leak since the caller expects resolved to be the same as the > returned value. > > Return NULL and set errno to ENAMETOOLONG if the result exceeds > PATH_MAX. This fixes [BZ #28770], which is CVE-2021-3998. > > Signed-off-by: Siddhesh Poyarekar LGTM, thanks. Reviewed-by: Adhemerval Zanella > --- > NEWS | 4 +++ > stdlib/Makefile | 1 + > stdlib/canonicalize.c | 12 +++++++-- > stdlib/tst-realpath-toolong.c | 48 +++++++++++++++++++++++++++++++++++ > 4 files changed, 63 insertions(+), 2 deletions(-) > create mode 100644 stdlib/tst-realpath-toolong.c > > diff --git a/NEWS b/NEWS > index 38802f0673..5c63cef156 100644 > --- a/NEWS > +++ b/NEWS > @@ -163,6 +163,10 @@ Security related changes: > CVE-2022-23218: Passing an overlong file name to the svcunix_create > legacy function could result in a stack-based buffer overflow. > > + CVE-2021-3998: Passing a path longer than PATH_MAX to the realpath > + function could result in a memory leak and potential access of > + uninitialized memory. > + > The following bugs are resolved with this release: > > [The release manager will add the list generated by > diff --git a/stdlib/Makefile b/stdlib/Makefile > index 1e81f98fac..8236741984 100644 > --- a/stdlib/Makefile > +++ b/stdlib/Makefile > @@ -109,6 +109,7 @@ tests := \ > tst-random \ > tst-random2 \ > tst-realpath \ > + tst-realpath-toolong \ > tst-secure-getenv \ > tst-setcontext \ > tst-setcontext2 \ > diff --git a/stdlib/canonicalize.c b/stdlib/canonicalize.c > index f36bdf4c76..732dc7ea46 100644 > --- a/stdlib/canonicalize.c > +++ b/stdlib/canonicalize.c > @@ -400,8 +400,16 @@ realpath_stk (const char *name, char *resolved, > > error: > *dest++ = '\0'; > - if (resolved != NULL && dest - rname <= get_path_max ()) > - rname = strcpy (resolved, rname); > + if (resolved != NULL) > + { > + if (dest - rname <= get_path_max ()) > + rname = strcpy (resolved, rname); > + else > + { > + failed = true; > + __set_errno (ENAMETOOLONG); > + } > + } > > error_nomem: > scratch_buffer_free (&extra_buffer); > diff --git a/stdlib/tst-realpath-toolong.c b/stdlib/tst-realpath-toolong.c > new file mode 100644 > index 0000000000..f10653f05b > --- /dev/null > +++ b/stdlib/tst-realpath-toolong.c > @@ -0,0 +1,48 @@ > +/* Verify that realpath returns NULL with ENAMETOOLONG if the result exceeds > + NAME_MAX. > + Copyright The GNU Toolchain Authors. > + This file is part of the GNU C Library. > + > + The GNU C Library is free software; you can redistribute it and/or > + modify it under the terms of the GNU Lesser General Public > + License as published by the Free Software Foundation; either > + version 2.1 of the License, or (at your option) any later version. > + > + The GNU C Library is distributed in the hope that it will be useful, > + but WITHOUT ANY WARRANTY; without even the implied warranty of > + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > + Lesser General Public License for more details. > + > + You should have received a copy of the GNU Lesser General Public > + License along with the GNU C Library; if not, see > + . */ > + > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > + > +#define BASENAME "tst-realpath-toolong." > + > +int > +do_test (void) > +{ > + char *base = support_create_and_chdir_toolong_temp_directory (BASENAME); > + > + char buf[PATH_MAX + 1]; > + const char * const res = realpath (".", buf); > + > + /* canonicalize.c states that if the real path is >= PATH_MAX, then > + realpath returns NULL and sets ENAMETOOLONG. */ > + TEST_VERIFY_EXIT (res == NULL && errno == ENAMETOOLONG); > + > + free (base); > + return 0; > +} > + > +#include