Issue metadata
Sign in to add a comment
|
Usages of realpath() are subject to bufferoverflows()
Reported by
mishra.d...@gmail.com,
Jun 26 2018
|
||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Firefox/60.0 Steps to reproduce the problem: Hi Team, https://github.com/chromium/chromium/blob/master/base/base_paths_posix.cc#L63 i.e if (realpath(getexecname(), bin_dir) == NULL) { This function does not protect against buffer overflows, and some implementations can overflow internally such as (CWE-120/CWE-785!). Ensure that the destination buffer is at least of size MAXPATHLEN, andto protect against implementation problems, the input argument should also be checked to ensure it is no larger than MAXPATHLEN. Request team to please have a look and validate. Thank you What is the expected behavior? What went wrong? Usages of realpath() are subject to bufferoverflows() Did this work before? N/A Chrome version: 69.0.3473.1 Channel: stable OS Version: 10.0 Flash Version:
,
Oct 3
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||
Comment 1 by infe...@chromium.org
, Jun 26 2018