[PATCH 3/4] stdlib: Fix arithmetic overflows in realpath [BZ #26592]

[Adhemerval Zanella]

Ping.

On 10/09/2020 12:19, Adhemerval Zanella wrote:
> The realpath uses an end-of-array pointer 'rpath_limit', and makes
> invalid (overflowing) comparisons against it to catch overflow:
> 
>   117       /* Find end of path component.  */
>   118       if (dest + (end-start) >= rpath_limit)
> 
> I could not see a easy way to stress this issue since it rely on how
> the input argument is layout in memory along with a large filename
> name that trigger the overflow comparison.  However, the fix is
> simple enough where it simple reorganize arithmetic in the comparison.
> 
> Checked on x86_64-linux-gnu and i686-linux-gnu.
> ---
>  stdlib/canonicalize.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/stdlib/canonicalize.c b/stdlib/canonicalize.c
> index 6798ed8963..44a25a9a59 100644
> --- a/stdlib/canonicalize.c
> +++ b/stdlib/canonicalize.c
> @@ -136,7 +136,7 @@ __realpath (const char *name, char *resolved)
>            if (dest[-1] != '/')
>              *dest++ = '/';
>  
> -          if (dest + (end - start) >= rpath_limit)
> +          if (end - start >= rpath_limit - dest)
>              {
>                ptrdiff_t dest_offset = dest - rpath;
>                char *new_rpath;
>