fix stack overflow building absolute path from relative symlink target

cf-agent/verify_files_utils.c

@@ -1338,16 +1338,26 @@ static PromiseResult LinkCopy(EvalContext *ctx, char *sourcefile, char *destfile
                 strlcpy(vbuff, changes_sourcefile, CF_BUFSIZE);
                 ChopLastNode(vbuff);
                 AddSlash(vbuff);
-                strncat(vbuff, chrooted_linkbuf, CF_BUFSIZE - 1);
-                strlcpy(chrooted_linkbuf, vbuff, CF_BUFSIZE - 1);
+                if (strlcat(vbuff, chrooted_linkbuf, sizeof(vbuff)) >= sizeof(vbuff) ||
+                    strlcpy(chrooted_linkbuf, vbuff, sizeof(chrooted_linkbuf)) >= sizeof(chrooted_linkbuf))
+                {
+                    RecordFailure(ctx, pp, attr,
+                                  "Absolute target of link '%s' is too long", sourcefile);
+                    return PROMISE_RESULT_FAIL;
+                }
             }
             else
             {
                 strlcpy(vbuff, sourcefile, CF_BUFSIZE);
                 ChopLastNode(vbuff);
                 AddSlash(vbuff);
-                strncat(vbuff, linkbuf, CF_BUFSIZE - 1);
-                strlcpy(linkbuf, vbuff, CF_BUFSIZE - 1);
+                if (strlcat(vbuff, linkbuf, sizeof(vbuff)) >= sizeof(vbuff) ||
+                    strlcpy(linkbuf, vbuff, sizeof(linkbuf)) >= sizeof(linkbuf))
+                {
+                    RecordFailure(ctx, pp, attr,
+                                  "Absolute target of link '%s' is too long", sourcefile);
+                    return PROMISE_RESULT_FAIL;
+                }
             }
         }
     }

libpromises/files_links.c

@@ -528,7 +528,13 @@ bool KillGhostLink(EvalContext *ctx, const char *name, const Attributes *attr, c
         }
     }
 
-    strcat(linkpath, linkbuf);
+    if (strlcat(linkpath, linkbuf, sizeof(linkpath)) >= sizeof(linkpath))
+    {
+        Log(LOG_LEVEL_ERR,
+            "Internal limit reached in KillGhostLink(),"
+            " path too long: '%s' + '%s'", linkpath, linkbuf);
+        return false;
+    }
     CompressPath(tmp, sizeof(tmp), linkpath);
 
     if (stat(tmp, &statbuf) == -1)    /* link points nowhere */

tests/unit/files_links_test.c

@@ -25,7 +25,10 @@
 #include <test.h>
 
 #include <cf3.defs.h>
-#include <files_links.h>                                       /* ExpandLinks */
+#include <files_links.h>                             /* ExpandLinks, KillGhostLink */
+#include <attributes.h>                                            /* Attributes */
+#include <unistd.h>                                          /* symlink, unlink */
+#include <errno.h>                                                 /* errno */
 
 /* A single path component longer than the internal node buffer
  * (CF_MAXLINKSIZE) overflowed the stack in ExpandLinks(): the parse into
@@ -44,12 +47,48 @@ static void test_expand_links_long_component(void)
     assert_false(ret);
 }
 
+/* KillGhostLink() rebuilds the absolute target of a relative symlink by
+ * appending the readlink() result onto the link's directory in a CF_BUFSIZE
+ * buffer. The append was an unbounded strcat(), so a symlink whose relative
+ * target is near CF_BUFSIZE overflowed the stack. It must bail out instead. */
+static void test_kill_ghost_link_long_target(void)
+{
+    char tmpl[] = "/tmp/cfghostXXXXXX";
+    const char *dir = mkdtemp(tmpl);
+    assert_true(dir != NULL);
+
+    char linkpath[256];
+    xsnprintf(linkpath, sizeof(linkpath), "%s/l", dir);
+
+    char target[CF_BUFSIZE];
+    memset(target, 'x', sizeof(target) - 1);
+    target[sizeof(target) - 1] = '\0';
+    if (symlink(target, linkpath) != 0)
+    {
+        /* Some platforms (e.g. macOS) refuse targets this long, in which
+         * case the overflow cannot be reached and there's nothing to test. */
+        assert_int_equal(errno, ENAMETOOLONG);
+        rmdir(dir);
+        return;
+    }
+
+    Attributes attr = { 0 };
+    attr.link.when_no_file = cfa_delete;
+    PromiseResult result = PROMISE_RESULT_NOOP;
+
+    assert_false(KillGhostLink(NULL, linkpath, &attr, NULL, &result));
+
+    unlink(linkpath);
+    rmdir(dir);
+}
+
 int main()
 {
     PRINT_TEST_BANNER();
 
     const UnitTest tests[] = {
         unit_test(test_expand_links_long_component),
+        unit_test(test_kill_ghost_link_long_target),
     };
 
     return run_tests(tests);