NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

lib/60949: pthread_getname_np can write to empty buffer if there is no thread name



>Number:         60949
>Category:       lib
>Synopsis:       pthread_getname_np can write to empty buffer if there is no thread name
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 01 12:40:01 +0000 2026
>Originator:     Jonas Böttiger
>Release:        current
>Organization:
Rust library team
>Environment:
>Description:
pthread_getname_np does not check whether the buffer is zero-sized before writing a NUL-terminator in the case where there is no thread name (https://github.com/NetBSD/src/blob/26c769bcf6ba2f6cf94679a4a745730efccacc3e/lib/libpthread/pthread.c#L819), resulting in undefined behaviour if passing a zero-sized buffer to pthread_getname_np.

I discovered this while working on miri support for NetBSD (see https://github.com/rust-lang/miri/pull/5109). In all likelihood this is only of theoretical concern, but it is something other BSDs avoid: https://cgit.freebsd.org/src/tree/lib/libthr/thread/thr_info.c#n139.
>How-To-Repeat:

>Fix:
Passing a zero length should be either be documented as undefined behaviour, or pthread_getname_np should check for that condition and not write a NUL terminator.




Home | Main Index | Thread Index | Old Index