tech-security archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]


NetBSD realpath(3) has an extension not in the POSIX.1 specification:

If an error occurs, realpath() returns NULL,
and if resolvedname was not allocated by realpath(), it will
contain the pathname which caused the problem.

Returning in the buffer designed to be defined with the correct result
(if not NULL) precisely the erroneous path chunk, is expecting to much
about the i.e. that they will test the return value of realpath(3)
without taking resolvedname for granted and correctly defined or the
empty string.

And this is precisely what the NetBSD src does: the mount incarnation
all use src/sbin/mount/pathadj.c, that does strictly nothing useful with
the return value of realpath(3) (it returns nothing and doesn't exit on
error)---note too: if "adjusted" is NULL, the returned allocated buffer
by realpath(3) is leaked by pathadj().

This does mean that calling realpath(3) with an input on which
realpath(3) will choke leads to precisely call mount() with the
offending part.

IMO, this extension to realpath(3) behavior should be suppressed, and
pathadj() should be fixed.
        Thierry Laronde <tlaronde +AT+ polynum +dot+ com>
Key fingerprint = 0FF7 E906 FBAF FE95 FD89  250D 52B1 AE95 6006 F40C

Home | Main Index | Thread Index | Old Index