Skip to contentSkip to conversation

Fix possible race condition in readlink.2 example

PATCH In review Chuck Coffing 2 participants 2 messages Jul 15, 2013 – Jul 18, 2013 1 message not in the archive Man-pages: manual pages for Linux -- Sections 2, 3, 4, 5, and 7

lore
Share & tools
lore

Chuck Coffing

author
#0 lore raw

PATCH 1/1 Fix possible race condition in readlink.2 example

Hi Michael,

I noticed that the example in the readlink.2 man pages does error checking for a race condition that would cause the value of the symbolic link to get larger. However, it doesn't handle the opposite case, in which the value gets shorter. (The NULL terminator is always set at the old, longer offset.) This could cause a program to operate on uninitialized data.

Here's a patch against 3.52:

Quoted 1 line

From 3db3021cc137937c79f95d2aa1c2820b20732c22 Mon Sep 17 00:00:00 2001

From: Chuck Coffing <clc-FrUbXkNCsVf2fBVCVOL8/[email protected]>
Date: Mon, 15 Jul 2013 10:11:15 -0600
Subject: [PATCH] Fix possible race condition in readlink.2 example

---
 man2/readlink.2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
man2/readlink.2 +1 -1
index f4ee2cb..9633149 100644
@@ -204,7 +204,7 @@ main(int argc, char *argv[])
         exit(EXIT_FAILURE);
     }
 
-    linkname[sb.st_size] = \(aq\\0\(aq;
+    linkname[r] = \(aq\\0\(aq;
 
     printf("\(aq%s\(aq points to \(aq%s\(aq\\n", argv[1], linkname);
Signature · 6 lines
1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): 20130715161929.GA22636-sklCMb5Bxfd6qHUw6WWyqb5k8TFzwjDl@public.gmane.org

#2 lore raw
Quoted 10 lines · Chuck Coffing

Hi Michael,

I noticed that the example in the readlink.2 man pages does error checking for a race condition that would cause the value of the symbolic link to get larger. However, it doesn't handle the opposite case, in which the value gets shorter. (The NULL terminator is always set at the old, longer offset.) This could cause a program to operate on uninitialized data.

Here's a patch against 3.52:

Thanks, Chuck. Applied.

Cheers,

Michael

Quoted 15 lines
Quoted 1 line

From 3db3021cc137937c79f95d2aa1c2820b20732c22 Mon Sep 17 00:00:00 2001

From: Chuck Coffing <clc-FrUbXkNCsVf2fBVCVOL8/[email protected]>
Date: Mon, 15 Jul 2013 10:11:15 -0600
Subject: [PATCH] Fix possible race condition in readlink.2 example

---
 man2/readlink.2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
man2/readlink.2 +0 -0
index f4ee2cb..9633149 100644

man2/readlink.2 main(int argc, char *argv[]) · line 210

Quoted 8 lines
man2/readlink.2 +1 -1
@@ -204,7 +204,7 @@ main(int argc, char *argv[])
         exit(EXIT_FAILURE);
     }
 
-    linkname[sb.st_size] = \(aq\\0\(aq;
+    linkname[r] = \(aq\\0\(aq;
 
     printf("\(aq%s\(aq points to \(aq%s\(aq\\n", argv[1], linkname);

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html