Patches item #1298813, was opened at 2005-09-22 10:54
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=305470&aid=1298813&group_id=5470
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Core (C code)
Group: Python 2.5
Status: Open
Resolution: None
Priority: 5
Submitted By: Mihai Ibanescu (misa)
Assigned to: Nobody/Anonymous (nobody)
Summary: sysmodule.c: realpath() is unsafe
Initial Comment:
realpath() will dereference all symlinks and resolve
references to /./ and /../ (and so on). realpath
accepts a source buffer and a destination buffer to
copy the resolved path into. On certain systems
PATH_MAX can be of arbitrary size, while the buffer
passed in would be of a limiited size.
There is no way to specify how long your "resolved"
buffer is, therefore it is possible for one to overflow it.
According to the man page:
BUGS
Never use this function. It is broken by
design since it is impossible
to determine a suitable size for the output
buffer. According to POSIX
a buffer of size PATH_MAX suffices, but
PATH_MAX need not be a defined
constant, and may have to be obtained using
pathconf(). And asking
pathconf() does not really help, since on the
one hand POSIX warns that
the result of pathconf() may be huge and
unsuitable for mallocing mem-
ory. And on the other hand pathconf() may
return -1 to signify that
PATH_MAX is not bounded.
glibc has certain extensions to avoid the buffer
overflow. One option is to use
canonicalize_file_name(), another is to specify a NULL
as the second argument to realpath() (which essentially
makes it behave like canonicalize_file_name(). Relevant
documentation:
info libc
http://www.delorie.com/gnu/docs/glibc/libc_279.html
Attached is a patch to use canonicalize_file_name if
available.
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=305470&aid=1298813&group_id=5470
_______________________________________________
Patches mailing list
[email protected]
http://mail.python.org/mailman/listinfo/patches
