PIPE-10460 FuzzerUtilLinux#6
Draft
SB-PawanN wants to merge 5 commits into
Draft
Conversation
There was a problem hiding this comment.
Pull request overview
This PR hardens libFuzzer’s Linux ExecuteCommand() implementation by replacing system() (shell invocation) with a fork()/execvp()-based execution path plus character allowlist validation, aiming to mitigate command/argument injection risks.
Changes:
- Replaced Linux
ExecuteCommand()fromsystem(Command.c_str())tofork()+execvp()execution. - Added allowlist-based parsing of the command string into an
argvarray, rejecting disallowed characters and malformed escapes. - Added
waitpid()handling to collect the child status.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+29
to
+31
| // Parse command as an argv list with allowlist validation. | ||
| // Backslash escapes allow literal special characters (e.g. space) inside | ||
| // arguments while rejecting malformed escape sequences. |
Extended ExecuteCommand to support output redirection (>) and stderr merging (2>&1) without invoking a shell, addressing review comment r3512544355. The implementation: - Parses ">" and "2>&1" syntax in the command string - Validates output filenames using the same allowlist rules - Implements redirection via open()/dup2() in the child process - Maintains security by avoiding shell invocation This allows FuzzerDriver.cpp's usage (line 210) to work correctly while preserving the security hardening against command injection.
Addressed code review feedback: - Fixed return value to properly extract exit code using WEXITSTATUS() - Made isspace() usage consistent with unsigned char casts - Changed file permissions from 0644 to 0600 for better security - Added comment explaining restrictive permissions These improvements enhance robustness and security while maintaining the shell-free output redirection functionality.
Removed unused 'Start' variable that was calculated but never used.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[SECURITY] Harden Linux ExecuteCommand Path for CWE-78/CWE-88 (PIPE-10460)
This PR fixes command and argument injection risk in the Linux ExecuteCommand path by replacing shell-based system execution with fork + execvp and strict allowlist validation in FuzzerUtilLinux.cpp.
Problem
The previous Linux implementation executed a raw command string through a shell, enabling:
Solution
Testing
Important Scope Note
This PR is intentionally scoped to the Linux ExecuteCommand path only. It does not remediate remaining shell-based execution paths on POSIX that still use popen:
Those paths require a follow-up fix to move to a no-shell model (pipe + fork + execve with explicit argv).
JIRA: PIPE-10460
Deadline: July 8, 2026