From patchwork Mon May 5 13:00:07 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aurelien Jarno X-Patchwork-Id: 803 Return-Path: X-Original-To: siddhesh@wilcox.dreamhost.com Delivered-To: siddhesh@wilcox.dreamhost.com Received: from homiemail-mx23.g.dreamhost.com (mx2.sub5.homie.mail.dreamhost.com [208.113.200.128]) by wilcox.dreamhost.com (Postfix) with ESMTP id DCA8C360076 for ; Mon, 5 May 2014 06:00:30 -0700 (PDT) Received: by homiemail-mx23.g.dreamhost.com (Postfix, from userid 14307373) id 78EFC63703041; Mon, 5 May 2014 06:00:30 -0700 (PDT) X-Original-To: glibc@patchwork.siddhesh.in Delivered-To: x14307373@homiemail-mx23.g.dreamhost.com Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by homiemail-mx23.g.dreamhost.com (Postfix) with ESMTPS id 52BE863703047 for ; Mon, 5 May 2014 06:00:30 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:cc:subject:date:message-id; q=dns; s= default; b=Hrjt2qCU/0lKvzCtYyg1MwmdGgIvRlZNBLPEFH87yo+eCrLqj/vp5 WA3yrYGMFMeABpVzWjVTlY8WDORrWfgiVv5QZuNAfpXD+1IxStC00yaUTejo3NVv /qmMHCJry7dGDZM1De15KtZ9Lw5VvLWCnFGmCZPZVj5BOFgl4gWjio= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:cc:subject:date:message-id; s=default; bh=4dp+gL5Nyf3nq0RxQAJ6I6t9Or0=; b=r9EMiYRUgOIdE+JryDNHbCd3UjRg LCnZlB9rGLPjeRckpUDm3dQ4nJvj1O97dtRx57scqY9vYr6DgbC/h2M1E4ocgp75 eJ1QviClde7dvFmjTtNl7gTeG6V1L0ZINqoQpgbkyf79ZcNsyzmBexIXqpjmuBRZ /U2BddWxb0BexyY= Received: (qmail 8785 invoked by alias); 5 May 2014 13:00:28 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 8772 invoked by uid 89); 5 May 2014 13:00:27 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-2.6 required=5.0 tests=BAYES_00, RP_MATCHES_RCVD autolearn=ham version=3.3.2 X-HELO: hall.aurel32.net From: Aurelien Jarno To: libc-alpha@sourceware.org Cc: Aurelien Jarno Subject: [PATCH] ptsname_r: don't leak unitialized memory Date: Mon, 5 May 2014 15:00:07 +0200 Message-Id: <1399294807-19817-1-git-send-email-aurelien@aurel32.net> X-DH-Original-To: glibc@patchwork.siddhesh.in If the fd refers to a terminal device, but not a pty master, the TIOCGPTN ioctl returns with ENOTTY. This error is not caught, and the possibly undefined buffer passed to ptsname_r is sent directly to the stat64 syscall. Fix this by using a fallback to the old method only if the TIOCGPTN ioctl fails with EINVAL. This also fix the return value in that specific case (it return ENOENT without this patch). Note: this is Debian bug#741482, reported by Jakub Wilk --- ChangeLog | 6 ++++++ sysdeps/unix/sysv/linux/ptsname.c | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index ac0d69e..cda0e7c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2014-05-05 Aurelien Jarno + + * sysdeps/unix/sysv/linux/ptsname.c (__ptsname_internal): return + errno if the TIOCGPTN ioctl fails with an error different than + EINVAL. + 2014-05-04 Adam Conrad * locale/iso-4217.def: Reintroduce XDR currency. diff --git a/sysdeps/unix/sysv/linux/ptsname.c b/sysdeps/unix/sysv/linux/ptsname.c index ed39f8f..3fc14a7 100644 --- a/sysdeps/unix/sysv/linux/ptsname.c +++ b/sysdeps/unix/sysv/linux/ptsname.c @@ -105,7 +105,9 @@ __ptsname_internal (int fd, char *buf, size_t buflen, struct stat64 *stp) memcpy (__stpcpy (buf, devpts), p, &numbuf[sizeof (numbuf)] - p); } - else if (errno == EINVAL) + else if (errno != EINVAL) + return errno; + else #endif { char *p;