From 04b6c2e58486cfb30641633962249753052ba89f Mon Sep 17 00:00:00 2001 From: Eric Blake Date: Sat, 4 Feb 2012 11:11:40 -0700 Subject: [PATCH] canonicalize: avoid uninitialized memory use When DOUBLE_SLASH_IS_DISTINCT_ROOT is non-zero, then we were reading the contents of rpath[1] even when we had never written anything there, which meant that "///" would usually canonicalize to "/" but sometimes to "//" if a '/' was leftover in the heap. This condition could also occur via 'ln -s / //some/path' and canonicalizing //some/path, where we rewind rpath but do not clear out the previous round. Platforms where "//" and "/" are equivalent do not suffer from this read-beyond-written bounds. * lib/canonicalize-lgpl.c (__realpath): Avoid possibility of random '/' left in dest. * lib/canonicalize.c (canonicalize_filename_mode): Likewise. Signed-off-by: Eric Blake --- ChangeLog | 7 +++++++ lib/canonicalize-lgpl.c | 17 ++++++++++++----- lib/canonicalize.c | 17 ++++++++++++----- 3 files changed, 31 insertions(+), 10 deletions(-) diff --git a/ChangeLog b/ChangeLog index d5b72cad7..210bd10bc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2012-02-04 Eric Blake + + canonicalize: avoid uninitialized memory use + * lib/canonicalize-lgpl.c (__realpath): Avoid possibility of + random '/' left in dest. + * lib/canonicalize.c (canonicalize_filename_mode): Likewise. + 2012-02-04 Bruno Haible isatty: Fix test failure of ptsname_r on native Windows. diff --git a/lib/canonicalize-lgpl.c b/lib/canonicalize-lgpl.c index a61bef90e..7aa2d92cf 100644 --- a/lib/canonicalize-lgpl.c +++ b/lib/canonicalize-lgpl.c @@ -156,8 +156,12 @@ __realpath (const char *name, char *resolved) { rpath[0] = '/'; dest = rpath + 1; - if (DOUBLE_SLASH_IS_DISTINCT_ROOT && name[1] == '/' && name[2] != '/') - *dest++ = '/'; + if (DOUBLE_SLASH_IS_DISTINCT_ROOT) + { + if (name[1] == '/' && name[2] != '/') + *dest++ = '/'; + *dest = '\0'; + } } for (start = end = name; *start; start = end) @@ -298,9 +302,12 @@ __realpath (const char *name, char *resolved) if (buf[0] == '/') { dest = rpath + 1; /* It's an absolute symlink */ - if (DOUBLE_SLASH_IS_DISTINCT_ROOT - && buf[1] == '/' && buf[2] != '/') - *dest++ = '/'; + if (DOUBLE_SLASH_IS_DISTINCT_ROOT) + { + if (buf[1] == '/' && buf[2] != '/') + *dest++ = '/'; + *dest = '\0'; + } } else { diff --git a/lib/canonicalize.c b/lib/canonicalize.c index ed094b776..583c1a4af 100644 --- a/lib/canonicalize.c +++ b/lib/canonicalize.c @@ -145,8 +145,12 @@ canonicalize_filename_mode (const char *name, canonicalize_mode_t can_mode) rname_limit = rname + PATH_MAX; rname[0] = '/'; dest = rname + 1; - if (DOUBLE_SLASH_IS_DISTINCT_ROOT && name[1] == '/' && name[2] != '/') - *dest++ = '/'; + if (DOUBLE_SLASH_IS_DISTINCT_ROOT) + { + if (name[1] == '/' && name[2] != '/') + *dest++ = '/'; + *dest = '\0'; + } } for (start = name; *start; start = end) @@ -267,9 +271,12 @@ canonicalize_filename_mode (const char *name, canonicalize_mode_t can_mode) if (buf[0] == '/') { dest = rname + 1; /* It's an absolute symlink */ - if (DOUBLE_SLASH_IS_DISTINCT_ROOT - && buf[1] == '/' && buf[2] != '/') - *dest++ = '/'; + if (DOUBLE_SLASH_IS_DISTINCT_ROOT) + { + if (buf[1] == '/' && buf[2] != '/') + *dest++ = '/'; + *dest = '\0'; + } } else { -- 2.11.0