[llvm-dev] overflow at realpath()

[Dhiraj via llvm-dev]

Bug: https://bugs.llvm.org/show_bug.cgi?id=38116

File:
llvm-mirror/clang/blob/master/lib/Frontend/ModuleDependencyCollector.cpp#L108

i.e
if (!realpath(SrcPath.str().c_str(), CanonicalPath))

According to the documentation of realpath() the output buffer needs to be
at least of size PATH_MAX specifying output buffers large enough to handle
the maximum-size possible result from path manipulation functions. (In that
instance, buf's size comes from uv__fs_pathmax_size(). That function
attempts to use pathconf(path, _PC_PATH_MAX) as noted in the realpath(3)
docs)

But over here uv__fs_pathmax_size() nor pathconf(path, _PC_PATH_MAX) is
used.

Passing an inadequately-sized output buffer to a path manipulation function
can result in a buffer overflow. Such functions include realpath()
readlink() PathAppend() and others.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-dev/attachments/20180727/2cf40971/attachment.html>