develooper Front page | perl.perl5.porters | Postings from November 2003

Re: Cwd.xs: off-by-one buffer overflow in realpath()

Thread Previous | Thread Next
From:
Gisle Aas
Date:
November 3, 2003 14:02
Subject:
Re: Cwd.xs: off-by-one buffer overflow in realpath()
Message ID:
lrn0bddsbb.fsf@caliper.activestate.com
Rafael Garcia-Suarez <rgarciasuarez@free.fr> writes:

> H.Merijn Brand wrote:
> > On Mon 03 Nov 2003 22:35, Rafael Garcia-Suarez <rgarciasuarez@free.fr> wrote:
> > > H.Merijn Brand wrote:
> > > > On Mon 03 Nov 2003 22:24, Rafael Garcia-Suarez <rgarciasuarez@free.fr> wrote:
> > > > > Casey West wrote:
> > > > > > ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:08.realpath.asc 
> > > > > 
> > > > > Thanks, applied as #21646 to blead. (by hand, for some reason.)
> > > > > 
> > > > > > --- perl-current-orig/ext/Cwd/Cwd.xs    Thu May 16 18:16:19 2002
> > > > > > +++ perl-current/ext/Cwd/Cwd.xs Thu Oct 30 12:08:12 2003
> > > > > > @@ -166,7 +166,7 @@
> > > > > >                 rootd = 0;
> > > > > >  
> > > > > >         if (*wbuf) {
> > > > > > -               if (strlen(resolved) + strlen(wbuf) + rootd + 1 > MAXPATHLEN) {
> > > > > > +               if (strlen(resolved) + strlen(wbuf) + (1-rootd) + 1 > MAXPATHLEN) {
> > > > 
> > > > This correct? 1 *-* rootd
> > > > This is completely different from off-by-one, as the subject says
> > > 
> > > Looks correct to me. rootd is 0 or 1 depending on whether the path
> > > represents the root directory ("/\0") or not.
> > 
> > So the patch *reverses* rootd.
> > 
> > Would rootd^1 not be more obvious then? Or am I just nitpicking
> 
> You are just nitpicking ;-)
> 
> (I considered replacing rootd by notrootd, but negative booleans tend to be
> less readable, so I kept Casey's solution)

It is probably a good idea to keep in sync the the BSD source code so
applying the same patch as they did is the right thing.  If you want
nitpicking I would say you should break the line after '>' like they
did:

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-03:08/realpath.patch

Regards,
Gisle


Thread Previous | Thread Next


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About