[Bug libc/28770] New: Unexpected return value from realpath() for too long results (CVE-2021-3998)

[siddhesh at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28770

            Bug ID: 28770
           Summary: Unexpected return value from realpath() for too long
                    results (CVE-2021-3998)
           Product: glibc
           Version: 2.35
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: siddhesh at sourceware dot org
          Reporter: siddhesh at sourceware dot org
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

When the resolved_path argument for realpath is non-NULL and the result is
longer than PATH_MAX, the return value is an allocated string instead of
resolved_path, which may result in a memory leak since the caller expects
resolved_path.

Another problem with this behaviour is that if the caller uses resolved_path
instead of the return value from realpath; it may potentially end up using
uninitialized memory.

The expected behaviour in case of result being greater than PATH_MAX is to
return NULL and set ENAMETOOLONG.

-- 
You are receiving this mail because:
You are on the CC list for the bug.