From mboxrd@z Thu Jan  1 00:00:00 1970
X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/13025
Path: news.gmane.org!.POSTED!not-for-mail
From: Szabolcs Nagy <nsz@port70.net>
Newsgroups: gmane.linux.lib.musl.general
Subject: Re: overflow() at stdlib.h
Date: Thu, 12 Jul 2018 17:42:10 +0200
Message-ID: <20180712154209.GJ4418@port70.net>
References: <CAOs05YaDsSSctj=3che2OQ7Gqjd919NVsd_H=y1cbt0vDkH4aw@mail.gmail.com>
Reply-To: musl@lists.openwall.com
NNTP-Posting-Host: blaine.gmane.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: blaine.gmane.org 1531410019 24159 195.159.176.226 (12 Jul 2018 15:40:19 GMT)
X-Complaints-To: usenet@blaine.gmane.org
NNTP-Posting-Date: Thu, 12 Jul 2018 15:40:19 +0000 (UTC)
User-Agent: Mutt/1.9.1 (2017-09-22)
Cc: mortalfw@gmail.com
To: musl@lists.openwall.com
Original-X-From: musl-return-13041-gllmg-musl=m.gmane.org@lists.openwall.com Thu Jul 12 17:40:15 2018
Return-path: <musl-return-13041-gllmg-musl=m.gmane.org@lists.openwall.com>
Envelope-to: gllmg-musl@m.gmane.org
Original-Received: from mother.openwall.net ([195.42.179.200])
	by blaine.gmane.org with smtp (Exim 4.84_2)
	(envelope-from <musl-return-13041-gllmg-musl=m.gmane.org@lists.openwall.com>)
	id 1fddhW-0006C8-Go
	for gllmg-musl@m.gmane.org; Thu, 12 Jul 2018 17:40:14 +0200
Original-Received: (qmail 7450 invoked by uid 550); 12 Jul 2018 15:42:22 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
List-ID: <musl.lists.openwall.com>
Original-Received: (qmail 7429 invoked from network); 12 Jul 2018 15:42:21 -0000
Mail-Followup-To: musl@lists.openwall.com, mortalfw@gmail.com
Content-Disposition: inline
In-Reply-To: <CAOs05YaDsSSctj=3che2OQ7Gqjd919NVsd_H=y1cbt0vDkH4aw@mail.gmail.com>
Xref: news.gmane.org gmane.linux.lib.musl.general:13025
Archived-At: <http://permalink.gmane.org/gmane.linux.lib.musl.general/13025>

* m0rtal f!w <mortalfw@gmail.com> [2018-07-12 19:55:56 +0530]:
> Team,
> 
> File: stdlib.h#L:113
> 
> i.e
> char *realpath (const char *__restrict, char *__restrict);
> 
> According to the documentation of realpath() the output buffer needs to be
> at least of size PATH_MAX specifying output buffers large enough to handle
> the maximum-size possible result from path manipulation functions. (In that
> instance, buf's size comes from uv__fs_pathmax_size(). That function
> attempts to use pathconf(path, _PC_PATH_MAX) as noted in the realpath(3)
> docs)
> 

sounds like a portability bug in uv__fs_pathmax_size()

http://pubs.opengroup.org/onlinepubs/9699919799/functions/realpath.html

it should use PATH_MAX if defined or null pointer if not
to be portable to posix conforming targets.

> But over here uv__fs_pathmax_size() nor pathconf(path, _PC_PATH_MAX) is
> used.
> 

where?

> Passing an inadequately-sized output buffer to a path manipulation function
> can result in a buffer overflow. Such functions include realpath()
> readlink() PathAppend() and others.
> 
> Request team to have a look and validate.
> 
> 
> Thank you