]> Savannah Git Hosting - gnulib.git/commitdiff
canonicalize: fix pointer indexing bugs
authorPaul Eggert <eggert@cs.ucla.edu>
Thu, 10 Sep 2020 21:25:51 +0000 (14:25 -0700)
committerPaul Eggert <eggert@cs.ucla.edu>
Thu, 10 Sep 2020 21:50:04 +0000 (14:50 -0700)
Problem reported by Florian Weimer in:
https://lists.gnu.org/r/bug-gnulib/2020-09/msg00025.html
* lib/canonicalize-lgpl.c (__realpath):
* lib/canonicalize.c (canonicalize_filename_mode):
Do not generate a pointer past the end of the array.
* lib/canonicalize.c (canonicalize_filename_mode):
Do not use a pointer after passing it to realloc.

ChangeLog
lib/canonicalize-lgpl.c
lib/canonicalize.c

index 8b6f62bb129816834b4dd31502308fbbfa0b7e63..bf39cc512bcb493c2e76d3a98c6c08da1f3bb8b4 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2020-09-10  Paul Eggert  <eggert@cs.ucla.edu>
+
+       canonicalize: fix pointer indexing bugs
+       Problem reported by Florian Weimer in:
+       https://lists.gnu.org/r/bug-gnulib/2020-09/msg00025.html
+       * lib/canonicalize-lgpl.c (__realpath):
+       * lib/canonicalize.c (canonicalize_filename_mode):
+       Do not generate a pointer past the end of the array.
+       * lib/canonicalize.c (canonicalize_filename_mode):
+       Do not use a pointer after passing it to realloc.
+
 2020-09-09  Paul Eggert  <eggert@cs.ucla.edu>
 
        tempname: help merge with glibc
index 0b89d2a18426761c42a82f8fa074a79918fb948a..cc42662dbfe5b159be9325806b74291ffba0f0cd 100644 (file)
@@ -234,7 +234,7 @@ __realpath (const char *name, char *resolved)
           if (!ISSLASH (dest[-1]))
             *dest++ = '/';
 
-          if (dest + (end - start) >= rpath_limit)
+          if (rpath_limit - dest <= end - start)
             {
               ptrdiff_t dest_offset = dest - rpath;
               char *new_rpath;
index 8bb325414965dc2c63ba14d7b5c4225c44d5662b..aa0c3bd280a1280133229082270f0bc4e2108e11 100644 (file)
@@ -138,18 +138,15 @@ canonicalize_filename_mode (const char *name, canonicalize_mode_t can_mode)
       rname = xgetcwd ();
       if (!rname)
         return NULL;
-      dest = strchr (rname, '\0');
-      if (dest - rname < PATH_MAX)
+      size_t rnamelen = strlen (rname);
+      size_t rnamesize = rnamelen;  /* Lower bound on size; good enough.  */
+      if (rnamesize < PATH_MAX)
         {
-          char *p = xrealloc (rname, PATH_MAX);
-          dest = p + (dest - rname);
-          rname = p;
-          rname_limit = rname + PATH_MAX;
-        }
-      else
-        {
-          rname_limit = dest;
+          rnamesize = PATH_MAX;
+          rname = xrealloc (rname, rnamesize);
         }
+      dest = rname + rnamelen;
+      rname_limit = rname + rnamesize;
       start = name;
       prefix_len = FILE_SYSTEM_PREFIX_LEN (rname);
     }
@@ -204,7 +201,7 @@ canonicalize_filename_mode (const char *name, canonicalize_mode_t can_mode)
           if (!ISSLASH (dest[-1]))
             *dest++ = '/';
 
-          if (dest + (end - start) >= rname_limit)
+          if (rname_limit - dest <= end - start)
             {
               ptrdiff_t dest_offset = dest - rname;
               size_t new_size = rname_limit - rname;