[patch] Fix path length overflow in realpath (BZ#22786)

Alexander Monakov amonakov@ispras.ru
Tue Apr 10 15:31:00 GMT 2018


On Tue, 10 Apr 2018, Paul Pluzhnikov wrote:
> On Tue, Apr 10, 2018 at 1:08 AM Andreas Schwab <schwab@suse.de> wrote:
> 
> > Trying to allocate a block of INT_MAX+1 is rather likely to fail on a
> > 32-bit platform.
> 
> But that's the only way to test for this overflow AFAICT.
> 
> Should I submit the fix without the test?
> Should I submit the fix and the test, but disabled?

Don't know for the above, but for this question:

> Should I change the test to pass if allocation fails?

I believe returning EXIT_UNSUPPORTED would be reasonable.


Note that the testcase requires not only 2GB of address space, but also
causes faults and allocation for the whole range while doing the memset;
that sounds like a fairly heavy requirement.

Personally I'd rather avoid that by mmap'ing the buffer with MAP_NORESERVE,
initializing its head/tail as appropriate, and duplicating the "aaaa..." in
the middle by mmapping over pages in the interior with MAP_FIXED.

Alexander



More information about the Libc-alpha mailing list