Re: realpath(3): some buffer overflows and conformance issues

2017-12-23 Thread Todd C. Miller
Here's a diff for libc and ld.so without the asserts. - todd Index: lib/libc/stdlib/realpath.c === RCS file: /cvs/src/lib/libc/stdlib/realpath.c,v retrieving revision 1.21 diff -u -p -u -r1.21 realpath.c --- lib/libc/stdlib/realpath

Re: realpath(3): some buffer overflows and conformance issues

2017-12-22 Thread Todd C. Miller
On Fri, 22 Dec 2017 12:08:58 +0100, =?UTF-8?Q?Jan_Kokem=c3=bcller?= wrote: > I've found some buffer overflows in realpath(3). They are limited to > just two bytes though (one after the 'left' buffer and one before > 'symlink'), so the impact is minimal. > > Similar bugs in FreeBSD: > https://bugs.

realpath(3): some buffer overflows and conformance issues

2017-12-22 Thread Jan Kokemüller
Hi, I've found some buffer overflows in realpath(3). They are limited to just two bytes though (one after the 'left' buffer and one before 'symlink'), so the impact is minimal. Similar bugs in FreeBSD: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219154 Here is a list of issues: - The sta