Skip to content

file_path: avoid fortified realpath() buffer size abort#19037

Merged
LibretroAdmin merged 1 commit into
libretro:masterfrom
s3gfaultx:fix-realpath-buffer-overflow
May 14, 2026
Merged

file_path: avoid fortified realpath() buffer size abort#19037
LibretroAdmin merged 1 commit into
libretro:masterfrom
s3gfaultx:fix-realpath-buffer-overflow

Conversation

@s3gfaultx
Copy link
Copy Markdown
Contributor

Guidelines

  1. Rebase before opening a pull request
  2. If you are sending several unrelated fixes or features, use a branch and a separate pull request for each
  3. If possible try squashing everything in a single commit. This is particularly beneficial in the case of feature merges since it allows easy bisecting when a problem arises
  4. RetroArch codebase follows C89 coding rules for portability across many old platforms check using C89_BUILD=1

Description

Some distributions now build packages with stricter default toolchain hardening, including _FORTIFY_SOURCE=3. Under those settings, glibc’s fortified realpath() performs a compile/runtime object-size check on the destination buffer and aborts if it is smaller than the system PATH_MAX.

glibc's fortified realpath() checks that the destination buffer is at least PATH_MAX bytes. path_resolve_realpath() was passing the caller's buffer directly, which may be smaller than the system PATH_MAX despite being sized to RetroArch's PATH_MAX_LENGTH.

With _FORTIFY_SOURCE=3 this can abort in __realpath_chk when resolving core updater paths.

Resolve into an allocated realpath() buffer instead, then copy the result back into the caller-provided buffer using the provided length.

glibc's fortified realpath() checks that the destination buffer is at
least PATH_MAX bytes. path_resolve_realpath() was passing the caller's
buffer directly, which may be smaller than the system PATH_MAX despite
being sized to RetroArch's PATH_MAX_LENGTH.

With _FORTIFY_SOURCE=3 this can abort in __realpath_chk when resolving
core updater paths.

Resolve into an allocated realpath() buffer instead, then copy the result
back into the caller-provided buffer using the provided length.
@LibretroAdmin LibretroAdmin merged commit f2e32f0 into libretro:master May 14, 2026
43 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants