Skip to content

Fix buffer overflow in tst_tmpdir.c #1241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zkh8227 opened this issue May 15, 2025 · 1 comment
Open

Fix buffer overflow in tst_tmpdir.c #1241

zkh8227 opened this issue May 15, 2025 · 1 comment
Labels

Comments

@zkh8227
Copy link

zkh8227 commented May 15, 2025

I have identified these issues through static auditing and would like to provide a brief report. Considering this is a test tool, the impact of not fixing them may be minimal, but they are still worth noting:

1.Using sprintf without length checking may lead to buffer overflow.
https://github.com/linux-test-project/ltp/blob/master/lib/tst_tmpdir.c#L186

2.Missing fclose(f) in the return path causes resource leaks.
https://github.com/linux-test-project/ltp/blob/master/lib/safe_file_ops.c#L146
https://github.com/linux-test-project/ltp/blob/master/lib/safe_file_ops.c#L153
https://github.com/linux-test-project/ltp/blob/master/lib/safe_file_ops.c#L274

@metan-ucw
Copy link
Member

The missing fclose() does not actually leak anything, because tst_brkm_() ends up calling exit(). The return in the code is there only for the case where a test is in the cleanup() callback, where we do want to finish the cleanup even if error has happened and tst_brkm_() skips calling exit() in that case. However cleanup() is called at the end of the test and the test exits once cleanup() is finished. In summary in this case the static analysis is not smart enough to understand the complexity of the code.

The buffer overflow in tst_tmpdir.c should be fixed. I suppose that the best option would be passing dirfd to the rmobj() and use openat() instead of open() there.

@pevik pevik changed the title Some bug reports. The buffer overflow in tst_tmpdir.c May 16, 2025
@pevik pevik changed the title The buffer overflow in tst_tmpdir.c Fix buffer overflow in tst_tmpdir.c May 16, 2025
@pevik pevik added the bug label May 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants