@@ -108,6 +108,7 @@ tests := bug-fmtmsg1 \
tst-random \
tst-random2 \
tst-realpath \
+ tst-realpath-toolong \
tst-secure-getenv \
tst-setcontext \
tst-setcontext2 \
@@ -400,8 +400,16 @@ realpath_stk (const char *name, char *resolved,
error:
*dest++ = '\0';
- if (resolved != NULL && dest - rname <= get_path_max ())
- rname = strcpy (resolved, rname);
+ if (resolved != NULL)
+ {
+ if (dest - rname <= get_path_max ())
+ rname = strcpy (resolved, rname);
+ else
+ {
+ failed = true;
+ __set_errno (ENAMETOOLONG);
+ }
+ }
error_nomem:
scratch_buffer_free (&extra_buffer);
new file mode 100644
@@ -0,0 +1,78 @@
+/* Verify that realpath returns NULL with ENAMETOOLONG if the result exceeds
+ NAME_MAX.
+ Copyright The GNU Toolchain Authors.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <support/check.h>
+#include <support/temp_file.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#define BASENAME "tst-realpath-toolong."
+size_t nest_count;
+char dir[NAME_MAX + 1];
+
+int
+do_test (void)
+{
+ char *base = support_create_temp_directory (BASENAME);
+
+ TEST_VERIFY_EXIT (chdir (base) == 0);
+
+ memset (dir, 'X', sizeof (dir) - 1);
+ dir[NAME_MAX] = '\0';
+
+ /* Create directories and descend into them so that the final path is larger
+ than PATH_MAX. */
+ for (nest_count = 0; nest_count <= PATH_MAX / sizeof (dir); nest_count++)
+ {
+ TEST_VERIFY_EXIT (mkdir (dir, S_IRWXU) == 0);
+ TEST_VERIFY_EXIT (chdir (dir) == 0);
+ }
+
+ char buf[PATH_MAX + 1];
+ const char * const res = realpath (".", buf);
+
+ /* canonicalize.c states that if the real path is >= PATH_MAX, then
+ realpath returns NULL and sets ENAMETOOLONG. */
+ TEST_VERIFY_EXIT (res == NULL && errno == ENAMETOOLONG);
+
+ free (base);
+ return 0;
+}
+
+static void
+delete_subdirectories (const char *name)
+{
+ if (nest_count-- > 0)
+ delete_subdirectories (dir);
+ rmdir (dir);
+}
+
+static void
+do_cleanup (void)
+{
+ delete_subdirectories (BASENAME);
+}
+
+#define CLEANUP_HANDLER do_cleanup
+#include <support/test-driver.c>
realpath returns an allocated string when the result exceeds PATH_MAX, which is unexpected when its second argument is not NULL. This results in the second argument (resolved) being uninitialized and also results in a memory leak since the caller expects resolved to be the same as the returned value. Return NULL and set errno to ENAMETOOLONG if the result exceeds PATH_MAX. This fixes [BZ #28770], which is CVE-2021-3998. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> --- stdlib/Makefile | 1 + stdlib/canonicalize.c | 12 +++++- stdlib/tst-realpath-toolong.c | 78 +++++++++++++++++++++++++++++++++++ 3 files changed, 89 insertions(+), 2 deletions(-) create mode 100644 stdlib/tst-realpath-toolong.c