[Bug hurd/34504] New: Hurd readlinkat buffer overflow due to use of wrong length value

https://sourceware.org/bugzilla/show_bug.cgi?id=34504

            Bug ID: 34504
           Summary: Hurd readlinkat buffer overflow due to use of wrong
                    length value
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: hurd
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
                CC: [email protected], tschwinge at sourceware dot org
  Target Milestone: ---
             Flags: security+

The implementation ignores the caller-provided buffer size when copying the
symbolic link target:

  err = __io_read (file, &rbuf, &nread, 0, len);
  __mach_port_deallocate (__mach_task_self (), file);
  if (err)
    goto out;

  len = nread;
  if (rbuf != buf)
    {
      memcpy (buf, rbuf, len);
      __vm_deallocate (__mach_task_self (), (vm_address_t) rbuf, nread);
    }

It is conceivable that this crosses a trust boundary (even with a trusted
translator), so a CVE ID should probably be assigned for this.

-- 
You are receiving this mail because:
You are on the CC list for the bug.