bin/86135: Fwd: Latent buffer overflow in getcwd

Andrey Chernov ache at FreeBSD.ORG
Wed Sep 14 21:35:58 PDT 2005


On Thu, Sep 15, 2005 at 01:27:03PM +1000, Bruce Evans wrote:
> MAXPATHLEN is not very relevant here -- the size needed is just the size of
> our buffer, and MAXPATHLEN bytes is neither usually necessary nor always

While it can be so for "up", it is not so for "ep", since it is
filled by __getcwd() syscall and can't be bigger.

Could you consider MAXPATHLEN for "ep" and 1024 for "up" variant?

> - MAXPATHLEN is a misspelling of {PATH_MAX}.

It is BSDsm. getwd(1) refers to MAXPATHLEN too.

> - The magic 340 in the above was (1024 - 4) / strlen("../").  Now its
>   magic is deeper.  340 was wrong even when the initial upsize was known
>   to be (1024 - 4) since it didn't allow for the NUL terminator or mount
>   points.  The exact is something like
>   1 + (initial_upsize - {NAME_MAX} - 1) / strlen("../").

Why ever this magic needed? It is only in comment, not in code.

-- 
http://ache.pp.ru/


More information about the freebsd-bugs mailing list