overflow() at stdlib.h

["m0rtal f!w" <mortalfw@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 781 bytes --]

Team,

File: stdlib.h#L:113

i.e
char *realpath (const char *__restrict, char *__restrict);

According to the documentation of realpath() the output buffer needs to be
at least of size PATH_MAX specifying output buffers large enough to handle
the maximum-size possible result from path manipulation functions. (In that
instance, buf's size comes from uv__fs_pathmax_size(). That function
attempts to use pathconf(path, _PC_PATH_MAX) as noted in the realpath(3)
docs)

But over here uv__fs_pathmax_size() nor pathconf(path, _PC_PATH_MAX) is
used.

Passing an inadequately-sized output buffer to a path manipulation function
can result in a buffer overflow. Such functions include realpath()
readlink() PathAppend() and others.

Request team to have a look and validate.


Thank you

[-- Attachment #2: Type: text/html, Size: 916 bytes --]