fix(fileio): fix off-by-one in rename_with_tmp #27780
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cjwatson
force-pushed
the
rename-with-tmp-overflow
branch
from
63922ab
to
1ef1b5c
Compare
cjwatson
changed the title
`_FORTIFY_SOURCE` on Ubuntu caught this, resulting in:
[OLDTEST] Running test_rename
Failed: test_rename :: Nvim exited with non-zero code
Job exited with code 134
Screen (23 lines)
================================================================================
"test_rename.vim" "test_rename.vim" 120L, 3623B
Executing Test_rename_copy()
Executing Test_rename_dir_to_dir()
Executing Test_rename_fails()
Error detected while processing command line..script /<<BUILDDIR>>/neovim-0.9.5/test/old/testdir/runtest.vim[437]..function RunTheTest[44]..Test_rename_fails:
line 17:
E730: using List as a String
line 18:
E976: using Blob as a String
Executing Test_rename_file_ignore_case()*** buffer overflow detected ***: terminated
`snprintf`'s second parameter should be no greater than the number of
remaining bytes in the allocated object. We can see that this was off
by one, because in the simple case where `tail == tempname` (for a file
in the current directory), `rename_with_tmp` was passing `MAXPATHL + 2`
for an object allocated with a size of only `MAXPATHL + 1`.
Introduced in 5f1a153.
|
I'm not sure what the macos-12 functional test failure |
zeertzjq
approved these changes
Mar 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
_FORTIFY_SOURCEon Ubuntu caught this, resulting in:snprintf's second parameter should be no greater than the number of remaining bytes in the allocated object. We can see that this was off by one, because in the simple case wheretail == tempname(for a file in the current directory),rename_with_tmpwas passingMAXPATHL + 2for an object allocated with a size of onlyMAXPATHL + 1.Introduced in 5f1a153.