Skip to content

potential out of bounds write in get_qae_path #454

@olafhering

Description

@olafhering

get_qae_path() as of e880e54 uses readlink(). It may write the trailing nul-byte past the end of p_file_path if the size of the symlink string is buf_size or larger. I think the proper check of the return value of readlink in this context is if i < 0 || i > ((ssizte_t)buf_size - 1). This will detect truncation and any odd errors.

Other users of readlink() in this repository already do similar checks.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions