mbox series

[v2,0/3] Fixes for CVE-2021-3998 and CVE-2021-3999

Message ID 20220119082147.3352868-1-siddhesh@sourceware.org
Headers show
Series Fixes for CVE-2021-3998 and CVE-2021-3999 | expand

Message

Siddhesh Poyarekar Jan. 19, 2022, 8:21 a.m. UTC 
Add functions to make directory trees with paths longer than PATH_MAX
and use them to test fixes for CVE-2021-3998 and CVE-2021-3999.

Tested on x86_64 and i686.

Changes from v1:
- Try reducing directory name size to meet lower limits of some fuse
  filesystems
- Fixed review comments
- Credited Qualys in NEWS
- Use x* functions wherever possible
- Drop size check in linux getcwd implementation and rely only on the
  posix one to flag the error
- Fix formatting issues I had missed before.

Siddhesh Poyarekar (3):
  support: Add helpers to create paths longer than PATH_MAX
  realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX
    [BZ #28770]
  getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999)

 NEWS                                          |  10 +
 stdlib/Makefile                               |   1 +
 stdlib/canonicalize.c                         |  12 +-
 stdlib/tst-realpath-toolong.c                 |  49 ++++
 support/temp_file.c                           | 173 ++++++++++++-
 support/temp_file.h                           |   9 +
 sysdeps/posix/getcwd.c                        |   7 +
 sysdeps/unix/sysv/linux/Makefile              |   7 +-
 .../unix/sysv/linux/tst-getcwd-smallbuff.c    | 245 ++++++++++++++++++
 9 files changed, 501 insertions(+), 12 deletions(-)
 create mode 100644 stdlib/tst-realpath-toolong.c
 create mode 100644 sysdeps/unix/sysv/linux/tst-getcwd-smallbuff.c