clients/nycli/utils.c: Fix buffer overflow #34
Conversation
format_url() is only assigning 255 bytes for the rpath, but the path will be expanded by realpath() which can return a sring up to a maximum of PATH_MAX bytes. And, so as a result, if long path names are used or while creating playlists with multiple files we get a coredump with the error: *** buffer overflow detected ***: terminated Aborted (core dumped) Lets use PATH_MAX for rpath length so that we have buffer for the maximum return from realpath(). Signed-off-by: Sudip Mukherjee <[email protected]>
|
Looks great! Merged. Thank you! We'll need to add a runtime check for overflow as well. |
|
One thing slightly concerns me with this patch is that it's fixing one instance of I must admit I haven't tried this change, and it may break other things; I just came here from the linked Ubuntu bug while reviewing the update there, but it seems to me this might be a more wide-ranging issue than the one file patched here. |
|
Yeah, generally hardcoding arbitrary limits like I'm not sure how portable |
|
It's been a long time since I've done Windows development but I remember back on Windows 95, |
format_url() is only assigning 255 bytes for the rpath, but the path will be expanded by realpath() which can return a sring up to a maximum of PATH_MAX bytes. And, so as a result, if long path names are used or while creating playlists with multiple files we get a coredump with the error:
*** buffer overflow detected ***: terminated
Aborted (core dumped)
Lets use PATH_MAX for rpath length so that we have buffer for the maximum return from realpath().
Reported in Ubuntu at https://bugs.launchpad.net/ubuntu/+source/xmms2/+bug/2018449