Re: [pacman-dev] [PATCH 1/2] pacman: fix possible buffer overflow

2018-09-22 Thread Morgan Adamiec
On Sat, 22 Sep 2018 at 22:57, Andrew Gregory wrote: > Set errno to ENAMETOOLONG and return NULL, just like realpath. The problem still remains. You can input a filename that's < PATH_MAX and have it resolve to something > PATH_MAX. You have no way to print what that resolved path was. You can

Re: [pacman-dev] [PATCH 1/2] pacman: fix possible buffer overflow

2018-09-22 Thread Andrew Gregory
On 09/22/18 at 10:46pm, Morgan Adamiec wrote: > On Sat, 22 Sep 2018 at 22:20, Andrew Gregory > wrote: > > Good catch, but this approach allows lrealpath to allocate a buffer > > larger than PATH_MAX only to error if it actually does. lrealpath is > > intended to be the same as realpath (aside

Re: [pacman-dev] [PATCH 1/2] pacman: fix possible buffer overflow

2018-09-22 Thread Andrew Gregory
On 09/22/18 at 09:16pm, morganamilo wrote: > in the function query_fileowner, if the user enters a string longer > than PATH_MAX then rpath will buffer overflow when lrealpath tries to > strcat everything together. > > Even if we made sure filename was never longer than PATH_MAX this would > not

[pacman-dev] [PATCH 1/2] pacman: fix possible buffer overflow

2018-09-22 Thread morganamilo
in the function query_fileowner, if the user enters a string longer than PATH_MAX then rpath will buffer overflow when lrealpath tries to strcat everything together. Even if we made sure filename was never longer than PATH_MAX this would not help because lrealpath may concatenate filename with