From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/13024 Path: news.gmane.org!.POSTED!not-for-mail From: "m0rtal f!w" Newsgroups: gmane.linux.lib.musl.general Subject: overflow() at stdlib.h Date: Thu, 12 Jul 2018 19:55:56 +0530 Message-ID: Reply-To: musl@lists.openwall.com NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="000000000000358cdd0570ce2473" X-Trace: blaine.gmane.org 1531405519 1972 195.159.176.226 (12 Jul 2018 14:25:19 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Thu, 12 Jul 2018 14:25:19 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-13040-gllmg-musl=m.gmane.org@lists.openwall.com Thu Jul 12 16:25:15 2018 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.84_2) (envelope-from ) id 1fdcWw-0000O3-AD for gllmg-musl@m.gmane.org; Thu, 12 Jul 2018 16:25:14 +0200 Original-Received: (qmail 25660 invoked by uid 550); 12 Jul 2018 14:27:21 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 24286 invoked from network); 12 Jul 2018 14:26:08 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=vprAoKNxma2GSGAx3fbJTJW8ipDiemahVQ9pl/79CA8=; b=DluyZc5H9jsU5ZN/Q1/qeSXPGyYYt15JR9jdk+1Ds5elP9Rli2zA+HIiRVhjfGXYoj JyWURVWD+7riYVpjwNWbzZj1DPNcNTFZWdW6flWvIFUJ/6dD1FOchmZosImdIFxgUFMP tDWp+ereaEy2u+vyTs2j+VV2RuUsa1iw3KGuGqnIOH5NIwVljUPzdjqDgK3O+cW98ebv UWXetwnN4ag9oWRI7GI4K6gwZAmXtuv7qr87Yo1gMQPoKZ/IUOdJmi6kStR5poz4g9qF PbhlWtZc/pIn5EAzjH452LRnhz2kJfh5p5+EWgqVHGNxOHgzKPucRIz9IEIsSxkkTPTK hjEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=vprAoKNxma2GSGAx3fbJTJW8ipDiemahVQ9pl/79CA8=; b=fvKeJD/BEdX7VoxPmL0EmijIeOnEqwxm/FmnSpI8omoB5hrAn7jouPztHI/+z2JBWV EyaAUm7KGASMAvANPbQ6KEyBq1RvFu52WF6vSjqAT+yhuo+uw0Dp/cVG2gpFTZgW9deZ e3ZWFkEvO4/tJFIZpqtbCNgkT1gv1WVSmZrSHdCuuSZsu8Qxq+du+R1JlNDLcQqHkzUC bQS8mu5QX4JdszjMl7QUn3t55XPM2B8ac1tnMHLCBg8NSIEpkOm+elMGLOQ2gyveb1xG CGOVJGNfjFlOPjQodnFdt5XHh78mM8s2aHrff5CejUdY8gDQK5/E1oTmFzu0G4rb3lyK uYWg== X-Gm-Message-State: AOUpUlEw+pT6hdKwiJ/jO4qCJM2SeFY1Cm0b4qgDdMnRt2DeuPV1E1sM oBqmyX/FZ5cx8MF/avXUdH3AbGGYwNt8Gt9c2pvSsuSbX9I= X-Google-Smtp-Source: AAOMgpcx0OF4xLPbEGfPd15Ge+ey9aWq3yGwRnHYDCmeT0Olo5YY1zdgBTH/AXp0ZoyaGdvuihmLvRx6WTm+OV3JQzU= X-Received: by 2002:adf:ebc3:: with SMTP id v3-v6mr1921645wrn.33.1531405556615; Thu, 12 Jul 2018 07:25:56 -0700 (PDT) Xref: news.gmane.org gmane.linux.lib.musl.general:13024 Archived-At: --000000000000358cdd0570ce2473 Content-Type: text/plain; charset="UTF-8" Team, File: stdlib.h#L:113 i.e char *realpath (const char *__restrict, char *__restrict); According to the documentation of realpath() the output buffer needs to be at least of size PATH_MAX specifying output buffers large enough to handle the maximum-size possible result from path manipulation functions. (In that instance, buf's size comes from uv__fs_pathmax_size(). That function attempts to use pathconf(path, _PC_PATH_MAX) as noted in the realpath(3) docs) But over here uv__fs_pathmax_size() nor pathconf(path, _PC_PATH_MAX) is used. Passing an inadequately-sized output buffer to a path manipulation function can result in a buffer overflow. Such functions include realpath() readlink() PathAppend() and others. Request team to have a look and validate. Thank you --000000000000358cdd0570ce2473 Content-Type: text/html; charset="UTF-8"
Team,

File: stdlib.h#L:113

i.e
char *realpath (const char *__restrict, char *__restrict);

According to the documentation of realpath() the output buffer needs to be at least of size PATH_MAX specifying output buffers large enough to handle the maximum-size possible result from path manipulation functions. (In that instance, buf's size comes from uv__fs_pathmax_size(). That function attempts to use pathconf(path, _PC_PATH_MAX) as noted in the realpath(3) docs)

But over here uv__fs_pathmax_size() nor pathconf(path, _PC_PATH_MAX) is used.

Passing an inadequately-sized output buffer to a path manipulation function can result in a buffer overflow. Such functions include realpath() readlink() PathAppend() and others.

Request team to have a look and validate.


Thank you
--000000000000358cdd0570ce2473--