mbox

[0/3] Fixes for CVE-2021-3998 and CVE-2021-3999

Message ID 20220118090728.1825487-1-siddhesh@sourceware.org
Headers

Message

Siddhesh Poyarekar Jan. 18, 2022, 9:07 a.m. UTC 
  Add functions to make directory trees with paths longer than PATH_MAX
and use them to test fixes for CVE-2021-3998 and CVE-2021-3999.

Tested on x86_64.  Hurd build seems to already been broken, so I was
unable to test it.

Siddhesh Poyarekar (3):
  support: Add helpers to create paths longer than PATH_MAX
  realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX
    [BZ #28770]
  getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999)

 NEWS                                          |  10 +
 stdlib/Makefile                               |   1 +
 stdlib/canonicalize.c                         |  12 +-
 stdlib/tst-realpath-toolong.c                 |  48 ++++
 support/temp_file.c                           | 157 ++++++++++-
 support/temp_file.h                           |  11 +
 sysdeps/posix/getcwd.c                        |   7 +
 sysdeps/unix/sysv/linux/Makefile              |   7 +-
 sysdeps/unix/sysv/linux/getcwd.c              |   7 +
 .../unix/sysv/linux/tst-getcwd-smallbuff.c    | 245 ++++++++++++++++++
 10 files changed, 494 insertions(+), 11 deletions(-)
 create mode 100644 stdlib/tst-realpath-toolong.c
 create mode 100644 sysdeps/unix/sysv/linux/tst-getcwd-smallbuff.c