mirror of
https://sourceware.org/git/glibc.git
synced 2024-12-13 14:50:17 +00:00
fabef2edbc
Currently getcwd(3) can succeed without returning an absolute path
because the underlying getcwd syscall, starting with linux commit
v2.6.36-rc1~96^2~2, may succeed without returning an absolute path.
This is a conformance issue because "The getcwd() function shall
place an absolute pathname of the current working directory
in the array pointed to by buf, and return buf".
This is also a security issue because a non-absolute path returned
by getcwd(3) causes a buffer underflow in realpath(3).
Fix this by checking the path returned by getcwd syscall and falling
back to generic_getcwd if the path is not absolute, effectively making
getcwd(3) fail with ENOENT. The error code is chosen for consistency
with the case when the current directory is unlinked.
[BZ #22679]
CVE-2018-1000001
* sysdeps/unix/sysv/linux/getcwd.c (__getcwd): Fall back to
generic_getcwd if the path returned by getcwd syscall is not absolute.
* io/tst-getcwd-abspath.c: New test.
* io/Makefile (tests): Add tst-getcwd-abspath.
(cherry picked from commit 52a713fdd0)
67 lines
1.8 KiB
C
67 lines
1.8 KiB
C
/* BZ #22679 getcwd(3) should not succeed without returning an absolute path.
|
|
|
|
Copyright (C) 2018 Free Software Foundation, Inc.
|
|
This file is part of the GNU C Library.
|
|
|
|
The GNU C Library is free software; you can redistribute it and/or
|
|
modify it under the terms of the GNU Lesser General Public
|
|
License as published by the Free Software Foundation; either
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
The GNU C Library is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
License along with the GNU C Library; if not, see
|
|
<https://www.gnu.org/licenses/>. */
|
|
|
|
#include <errno.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <support/check.h>
|
|
#include <support/namespace.h>
|
|
#include <support/support.h>
|
|
#include <support/temp_file.h>
|
|
#include <support/test-driver.h>
|
|
#include <support/xunistd.h>
|
|
#include <unistd.h>
|
|
|
|
static char *chroot_dir;
|
|
|
|
/* The actual test. Run it in a subprocess, so that the test harness
|
|
can remove the temporary directory in --direct mode. */
|
|
static void
|
|
getcwd_callback (void *closure)
|
|
{
|
|
xchroot (chroot_dir);
|
|
|
|
errno = 0;
|
|
char *cwd = getcwd (NULL, 0);
|
|
TEST_COMPARE (errno, ENOENT);
|
|
TEST_VERIFY (cwd == NULL);
|
|
|
|
errno = 0;
|
|
cwd = realpath (".", NULL);
|
|
TEST_COMPARE (errno, ENOENT);
|
|
TEST_VERIFY (cwd == NULL);
|
|
|
|
_exit (0);
|
|
}
|
|
|
|
static int
|
|
do_test (void)
|
|
{
|
|
support_become_root ();
|
|
if (!support_can_chroot ())
|
|
return EXIT_UNSUPPORTED;
|
|
|
|
chroot_dir = support_create_temp_directory ("tst-getcwd-abspath-");
|
|
support_isolate_in_subprocess (getcwd_callback, NULL);
|
|
|
|
return 0;
|
|
}
|
|
|
|
#include <support/test-driver.c>
|