On 14/10/16 01:57, Bruno Haible wrote:
> Hi,
> 
> If pathconf (name, _PC_PATH_MAX) returns a PATH_MAX value > 2 GB,
> the readlink call in canonicalize-lgpl.c line 292 may return a length > 2 GB,
> therefore the implicit cast (assignment) to 'int' will produce a wrong value.
> 
> If you agree with this patch, it'd be a good idea to propagate it into glibc
> (it's the file stdlib/canonicalize.c there).

There is a later cast to (long int) that would
similarly truncate large values on LLP64 systems.
How about something like this as well?

@@ -311,7 +312,7 @@ __realpath (const char *name, char *resolved)
                 }

               len = strlen (end);
-              if ((long int) (n + len) >= path_max)
+              if (SIZE_MAX - len <= n || path_max <= n + len)
                 {
                   freea (buf);
                   __set_errno (ENAMETOOLONG);

thanks,
Pádraig

Reply via email to