file_path: avoid fortified realpath() buffer size abort#19037
Merged
LibretroAdmin merged 1 commit intoMay 14, 2026
Conversation
glibc's fortified realpath() checks that the destination buffer is at least PATH_MAX bytes. path_resolve_realpath() was passing the caller's buffer directly, which may be smaller than the system PATH_MAX despite being sized to RetroArch's PATH_MAX_LENGTH. With _FORTIFY_SOURCE=3 this can abort in __realpath_chk when resolving core updater paths. Resolve into an allocated realpath() buffer instead, then copy the result back into the caller-provided buffer using the provided length.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Guidelines
C89_BUILD=1Description
Some distributions now build packages with stricter default toolchain hardening, including
_FORTIFY_SOURCE=3. Under those settings, glibc’s fortifiedrealpath()performs a compile/runtime object-size check on the destination buffer and aborts if it is smaller than the systemPATH_MAX.glibc's fortified realpath() checks that the destination buffer is at least PATH_MAX bytes. path_resolve_realpath() was passing the caller's buffer directly, which may be smaller than the system PATH_MAX despite being sized to RetroArch's PATH_MAX_LENGTH.
With _FORTIFY_SOURCE=3 this can abort in __realpath_chk when resolving core updater paths.
Resolve into an allocated realpath() buffer instead, then copy the result back into the caller-provided buffer using the provided length.