From owner-freebsd-bugs@FreeBSD.ORG  Thu Sep 15 04:35:58 2005
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
X-Original-To: freebsd-bugs@FreeBSD.ORG
Delivered-To: freebsd-bugs@FreeBSD.ORG
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5F97416A41F;
	Thu, 15 Sep 2005 04:35:58 +0000 (GMT)
	(envelope-from ache@nagual.pp.ru)
Received: from nagual.pp.ru (nagual.pp.ru [194.87.13.69])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AF0C643D48;
	Thu, 15 Sep 2005 04:35:57 +0000 (GMT)
	(envelope-from ache@nagual.pp.ru)
Received: from nagual.pp.ru (ache@localhost [127.0.0.1])
	by nagual.pp.ru (8.13.4/8.13.4) with ESMTP id j8F4Ztei026827;
	Thu, 15 Sep 2005 08:35:55 +0400 (MSD)
	(envelope-from ache@nagual.pp.ru)
Received: (from ache@localhost)
	by nagual.pp.ru (8.13.4/8.13.4/Submit) id j8F4ZrBV026826;
	Thu, 15 Sep 2005 08:35:53 +0400 (MSD) (envelope-from ache)
Date: Thu, 15 Sep 2005 08:35:53 +0400
From: Andrey Chernov <ache@FreeBSD.ORG>
To: Bruce Evans <bde@zeta.org.au>
Message-ID: <20050915043553.GA26630@nagual.pp.ru>
Mail-Followup-To: Andrey Chernov <ache@freebsd.org>,
	Bruce Evans <bde@zeta.org.au>, Trevor Blackwell <tlb@tlb.org>,
	freebsd-bugs@FreeBSD.ORG, FreeBSD-gnats-submit@FreeBSD.ORG
References: <1126728802.42486.3239.camel@lab>
	<20050915120351.Q43928@delplex.bde.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050915120351.Q43928@delplex.bde.org>
User-Agent: Mutt/1.5.10i
Cc: FreeBSD-gnats-submit@FreeBSD.ORG, freebsd-bugs@FreeBSD.ORG,
	Trevor Blackwell <tlb@tlb.org>
Subject: Re: bin/86135: Fwd: Latent buffer overflow in getcwd
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 15 Sep 2005 04:35:58 -0000

On Thu, Sep 15, 2005 at 01:27:03PM +1000, Bruce Evans wrote:
> MAXPATHLEN is not very relevant here -- the size needed is just the size of
> our buffer, and MAXPATHLEN bytes is neither usually necessary nor always

While it can be so for "up", it is not so for "ep", since it is
filled by __getcwd() syscall and can't be bigger.

Could you consider MAXPATHLEN for "ep" and 1024 for "up" variant?

> - MAXPATHLEN is a misspelling of {PATH_MAX}.

It is BSDsm. getwd(1) refers to MAXPATHLEN too.

> - The magic 340 in the above was (1024 - 4) / strlen("../").  Now its
>   magic is deeper.  340 was wrong even when the initial upsize was known
>   to be (1024 - 4) since it didn't allow for the NUL terminator or mount
>   points.  The exact is something like
>   1 + (initial_upsize - {NAME_MAX} - 1) / strlen("../").

Why ever this magic needed? It is only in comment, not in code.

-- 
http://ache.pp.ru/