* [PATCH 2/2] paranoid safety fix to clamp pathnames to PATH_MAX
2022-09-03 11:20 6% [PATCH 0/2] various safety fixes from the Perl side Eric Wong
@ 2022-09-03 11:20 7% ` Eric Wong
0 siblings, 0 replies; 2+ results
From: Eric Wong @ 2022-09-03 11:20 UTC (permalink / raw)
To: mwrap-public
While I doubt Ruby (nor Perl) would store pathnames longer than
PATH_MAX by default, it's possible `eval' users to specify
whatever path (and line number) they wish to use.
Likely was the case with `# line $FILE' directives in Perl5
which prompted this clamping.
---
ext/mwrap/mwrap.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/ext/mwrap/mwrap.c b/ext/mwrap/mwrap.c
index 90f560e..08761d6 100644
--- a/ext/mwrap/mwrap.c
+++ b/ext/mwrap/mwrap.c
@@ -470,6 +470,8 @@ static struct src_loc *update_stats_rcu_lock(size_t size, uintptr_t caller)
/* avoid vsnprintf or anything which could call malloc here: */
len = strlen(ptr);
+ if (len > PATH_MAX)
+ len = PATH_MAX;
k = (void *)kbuf;
k->total = size;
dst = mempcpy(k->k, ptr, len);
^ permalink raw reply related [relevance 7%]
* [PATCH 0/2] various safety fixes from the Perl side
@ 2022-09-03 11:20 6% Eric Wong
2022-09-03 11:20 7% ` [PATCH 2/2] paranoid safety fix to clamp pathnames to PATH_MAX Eric Wong
0 siblings, 1 reply; 2+ results
From: Eric Wong @ 2022-09-03 11:20 UTC (permalink / raw)
To: mwrap-public
It's unlikely any of these affect applications today, but
Ractor use may increase in the future; and maybe some
maniac will use giant __FILE__ replacements via eval.
Eric Wong (2):
Ractor compatibility
paranoid safety fix to clamp pathnames to PATH_MAX
ext/mwrap/mwrap.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
^ permalink raw reply [relevance 6%]
Results 1-2 of 2 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2022-09-03 11:20 6% [PATCH 0/2] various safety fixes from the Perl side Eric Wong
2022-09-03 11:20 7% ` [PATCH 2/2] paranoid safety fix to clamp pathnames to PATH_MAX Eric Wong
Code repositories for project(s) associated with this public inbox
https://80x24.org/mwrap.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).