New issue
Advanced search Search tips

Issue 856624 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Jun 2018
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Security



Sign in to add a comment

Usages of realpath() are subject to bufferoverflows()

Reported by mishra.d...@gmail.com, Jun 26 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Firefox/60.0

Steps to reproduce the problem:
Hi Team, 

https://github.com/chromium/chromium/blob/master/base/base_paths_posix.cc#L63

i.e

if (realpath(getexecname(), bin_dir) == NULL) {

This function does not protect against buffer overflows, and some implementations can overflow internally such as (CWE-120/CWE-785!). 

Ensure that the destination buffer is at least of size MAXPATHLEN, andto protect against implementation problems, the input argument should also be checked to ensure it is no larger than MAXPATHLEN.

Request team to please have a look and validate.

Thank you

What is the expected behavior?

What went wrong?
Usages of realpath() are subject to bufferoverflows()

Did this work before? N/A 

Chrome version: 69.0.3473.1  Channel: stable
OS Version: 10.0
Flash Version:
 
Status: WontFix (was: Unconfirmed)
These are not user controlled params. Please explain a scenario where these values are user controlled and can be overflowed.
Project Member

Comment 2 by sheriffbot@chromium.org, Oct 3

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment