tech-userlevel archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

dirname(3) used on its own results?

Hi folks,

Should you be allowed to call dirname(3) on the results of a previous
dirname(3) call?

On NetBSD 8:

	thoreau 49994> cat dirtest.c
	#include <libgen.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

		char *p = "/a/b/c";

		while (strlen(p) > 1) {
			printf("p = %s\n", p);
			p = dirname(p);
	thoreau 49995> cc -o dirtest dirtest.c
	thoreau 49996> ./dirtest
	p = /a/b/c
	p = /a/b
	Abort (core dumped)
	thoreau 49996> 

and also fails Debian 9:

	otos 19> ./dirtest
	p = /a/b/c
	Segmentation fault
	otos 20> 

but works on NetBSD 6:

	backup 67> ./dirtest
	p = /a/b/c
	p = /a/b
	p = /a
	backup 68> 

On NetBSD 8 the abort is down to line 86 of lib/libc/gen/dirname.c where
for this call to memcpy(3):

                memcpy(buf, path, buflen);

buf and path are the same and then the SSP checks in __memcpy_chk()
abort because these (obviously!) overlap.

Is the correct fix to use memmove(3) instead of memcpy(3) inside
dirname(3), or are we restricted by some standard from having dirname(3)
be able to be called on the results of a previous dirname(3) call in
which case we should document this in the manpage?


Home | Main Index | Thread Index | Old Index