Re: [Python-Dev] unintentional and unsafe use of realpath()

2005-09-22 Thread misa
Filed: https://sourceforge.net/tracker/index.php?func=detailaid=1298813group_id=5470atid=305470 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169046 Misa On Wed, Sep 21, 2005 at 12:04:03PM -0400, Peter Jones wrote: On Wed, 2005-09-14 at 15:25 -0400, Peter Jones wrote: [ comments and a

Re: [Python-Dev] unintentional and unsafe use of realpath()

2005-09-21 Thread Peter Jones
On Wed, 2005-09-14 at 15:25 -0400, Peter Jones wrote: [ comments and a patch for sysmodule.c and some configure related files] ... and that patch has obvious problems as well. Here's a corrected one: --- Python-2.4.1/pyconfig.h.in.canonicalize 2005-09-14 11:47:04.0 -0400 +++

Re: [Python-Dev] unintentional and unsafe use of realpath()

2005-09-14 Thread Peter Jones
[re-adding Python-Dev] On Wed, 2005-09-14 at 02:00 +0200, Henrik Levkowetz wrote: Hi Peter, on 2005-09-10 21:29 Peter Jones said the following: Hi, In Python 2.4.1, Python/sysmodule.c includes a function PySys_SetArgv(). One of the things it does is attempt to resolve symbolic links

Re: [Python-Dev] unintentional and unsafe use of realpath()

2005-09-12 Thread Peter Jones
On Mon, 2005-09-12 at 17:23 +1200, Greg Ewing wrote: Peter Jones wrote: Another problem (which I have not fixed) is that when realpath() is used, in some cases MAXPATHLEN is smaller than the system's PATH_MAX/pathconf(path, _PC_PATH_MAX). The linux man page for realpath() has this at

Re: [Python-Dev] unintentional and unsafe use of realpath()

2005-09-11 Thread Greg Ewing
Peter Jones wrote: Another problem (which I have not fixed) is that when realpath() is used, in some cases MAXPATHLEN is smaller than the system's PATH_MAX/pathconf(path, _PC_PATH_MAX). The linux man page for realpath() has this at the bottom: BUGS Never use this function. It is

[Python-Dev] unintentional and unsafe use of realpath()

2005-09-10 Thread Peter Jones
Hi, In Python 2.4.1, Python/sysmodule.c includes a function PySys_SetArgv(). One of the things it does is attempt to resolve symbolic links into absolute paths. Currently, it uses readlink() if configure found that your system supports it, and then it tries to do the same thing again using