From a48cfb100aa47d349cd1b80d0efcca3231b6bfcd Mon Sep 17 00:00:00 2001 From: Siddhesh Poyarekar Date: Thu, 13 Jan 2022 11:28:36 +0530 Subject: [PATCH 1/2] realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770] realpath returns an allocated string when the result exceeds PATH_MAX, which is unexpected when its second argument is not NULL. This results in the second argument (resolved) being uninitialized and also results in a memory leak since the caller expects resolved to be the same as the returned value. Return NULL and set errno to ENAMETOOLONG if the result exceeds PATH_MAX. This fixes [BZ #28770], which is CVE-2021-3998. Reviewed-by: Adhemerval Zanella Signed-off-by: Siddhesh Poyarekar (cherry picked from commit ee8d5e33adb284601c00c94687bc907e10aec9bb) (cherry picked from commit f7a79879c0b2bef0dadd6caaaeeb0d26423e04e5 with conflict resoluation in stdlib/Makefile and NEWS) --- NEWS | 4 +++ stdlib/Makefile | 2 +- stdlib/canonicalize.c | 12 +++++++-- stdlib/tst-realpath-toolong.c | 49 +++++++++++++++++++++++++++++++++++ 4 files changed, 64 insertions(+), 3 deletions(-) create mode 100644 stdlib/tst-realpath-toolong.c diff --git a/NEWS b/NEWS index 028ed04ca2..0c3b1c2556 100644 --- a/NEWS +++ b/NEWS @@ -210,6 +210,10 @@ Security related changes: legacy function could result in a stack-based buffer overflow when using the "unix" protocol. Reported by Martin Sebor. + CVE-2021-3998: Passing a path longer than PATH_MAX to the realpath + function could result in a memory leak and potential access of + uninitialized memory. Reported by Qualys. + The following bugs are resolved with this release: [4737] libc: fork is not async-signal-safe diff --git a/stdlib/Makefile b/stdlib/Makefile index 7c15549caf..22de3867be 100644 --- a/stdlib/Makefile +++ b/stdlib/Makefile @@ -88,7 +88,7 @@ tests := tst-strtol tst-strtod testmb testrand testsort testdiv \ tst-swapcontext1 tst-setcontext4 tst-setcontext5 \ tst-setcontext6 tst-setcontext7 tst-setcontext8 \ tst-setcontext9 tst-bz20544 tst-canon-bz26341 \ - tst-realpath + tst-realpath tst-realpath-toolong tests-internal := tst-strtod1i tst-strtod3 tst-strtod4 tst-strtod5i \ tst-tls-atexit tst-tls-atexit-nodelete diff --git a/stdlib/canonicalize.c b/stdlib/canonicalize.c index cac1f73d74..20033b4885 100644 --- a/stdlib/canonicalize.c +++ b/stdlib/canonicalize.c @@ -400,8 +400,16 @@ realpath_stk (const char *name, char *resolved, error: *dest++ = '\0'; - if (resolved != NULL && dest - rname <= get_path_max ()) - rname = strcpy (resolved, rname); + if (resolved != NULL) + { + if (dest - rname <= get_path_max ()) + rname = strcpy (resolved, rname); + else + { + failed = true; + __set_errno (ENAMETOOLONG); + } + } error_nomem: scratch_buffer_free (&extra_buffer); diff --git a/stdlib/tst-realpath-toolong.c b/stdlib/tst-realpath-toolong.c new file mode 100644 index 0000000000..8bed772460 --- /dev/null +++ b/stdlib/tst-realpath-toolong.c @@ -0,0 +1,49 @@ +/* Verify that realpath returns NULL with ENAMETOOLONG if the result exceeds + NAME_MAX. + Copyright The GNU Toolchain Authors. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define BASENAME "tst-realpath-toolong." + +int +do_test (void) +{ + char *base = support_create_and_chdir_toolong_temp_directory (BASENAME); + + char buf[PATH_MAX + 1]; + const char *res = realpath (".", buf); + + /* canonicalize.c states that if the real path is >= PATH_MAX, then + realpath returns NULL and sets ENAMETOOLONG. */ + TEST_VERIFY (res == NULL); + TEST_VERIFY (errno == ENAMETOOLONG); + + free (base); + return 0; +} + +#include -- 2.25.1 From a4bc5841640e57f8d216e818b07cdd4c74f62815 Mon Sep 17 00:00:00 2001 From: Siddhesh Poyarekar Date: Mon, 24 Jan 2022 21:36:41 +0530 Subject: [PATCH 2/2] realpath: Avoid overwriting preexisting error (CVE-2021-3998) Set errno and failure for paths that are too long only if no other error occurred earlier. Related: BZ #28770 Reviewed-by: Andreas Schwab Signed-off-by: Siddhesh Poyarekar (cherry picked from commit 84d2d0fe20bdf94feed82b21b4d7d136db471f03) (cherry picked from commit d084965adc7baa8ea804427cccf973cea556d697) --- stdlib/canonicalize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stdlib/canonicalize.c b/stdlib/canonicalize.c index 20033b4885..fdeca42b83 100644 --- a/stdlib/canonicalize.c +++ b/stdlib/canonicalize.c @@ -404,7 +404,7 @@ error: { if (dest - rname <= get_path_max ()) rname = strcpy (resolved, rname); - else + else if (!failed) { failed = true; __set_errno (ENAMETOOLONG); -- 2.25.1