Skip to content

[3.4] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) #5992

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
May 14, 2018
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions Lib/test/test_os.py
Original file line number Diff line number Diff line change
Expand Up @@ -1851,6 +1851,46 @@ def test_12084(self):
os.remove(file1)
shutil.rmtree(level1)

@unittest.skip('Python 3.4 will crash safely on this buffer '
'overflow, but still crashes')
def test_buffer_overflow(self):
# Older versions would have a buffer overflow when detecting
# whether a link source was a directory. This test ensures we
# no longer crash, but does not otherwise validate the behavior
segment = 'X' * 27
path = os.path.join(*[segment] * 10)
test_cases = [
# overflow with absolute src
('\\' + path, segment),
# overflow dest with relative src
(segment, path),
# overflow when joining src
(path[:180], path[:180]),
]
for src, dest in test_cases:
try:
os.symlink(src, dest)
except FileNotFoundError:
pass
else:
try:
os.remove(dest)
except OSError:
pass
# Also test with bytes, since that is a separate code path.
try:
os.symlink(os.fsencode(src), os.fsencode(dest))
except ValueError:
# Conversion function checks for len(arg) >= 260
pass
except FileNotFoundError:
pass
else:
try:
os.remove(dest)
except OSError:
pass


@support.skip_unless_symlink
class NonLocalSymlinkTests(unittest.TestCase):
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Minimal fix to prevent buffer overrun in os.symlink on Windows
92 changes: 54 additions & 38 deletions Modules/posixmodule.c
Original file line number Diff line number Diff line change
Expand Up @@ -7200,90 +7200,98 @@ check_CreateSymbolicLink(void)
return (Py_CreateSymbolicLinkW && Py_CreateSymbolicLinkA);
}

/* Remove the last portion of the path */
static void
/* Remove the last portion of the path - return 0 on success */
static int
_dirnameW(WCHAR *path)
{
WCHAR *ptr;
size_t length = wcsnlen_s(path, MAX_PATH);
if (length == MAX_PATH) {
return -1;
}

/* walk the path from the end until a backslash is encountered */
for(ptr = path + wcslen(path); ptr != path; ptr--) {
for(ptr = path + length; ptr != path; ptr--) {
if (*ptr == L'\\' || *ptr == L'/')
break;
}
*ptr = 0;
return 0;
}

/* Remove the last portion of the path */
static void
/* Remove the last portion of the path - return 0 on success */
static int
_dirnameA(char *path)
{
char *ptr;
size_t length = strnlen_s(path, MAX_PATH);
if (length == MAX_PATH) {
return -1;
}

/* walk the path from the end until a backslash is encountered */
for(ptr = path + strlen(path); ptr != path; ptr--) {
for(ptr = path + length; ptr != path; ptr--) {
if (*ptr == '\\' || *ptr == '/')
break;
}
*ptr = 0;
return 0;
}

/* Is this path absolute? */
static int
_is_absW(const WCHAR *path)
{
return path[0] == L'\\' || path[0] == L'/' || path[1] == L':';
return path[0] == L'\\' || path[0] == L'/' ||
(path[0] && path[1] == L':');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ouch! ;-)


}

/* Is this path absolute? */
static int
_is_absA(const char *path)
{
return path[0] == '\\' || path[0] == '/' || path[1] == ':';
return path[0] == '\\' || path[0] == '/' ||
(path[0] && path[1] == ':');

}

/* join root and rest with a backslash */
static void
/* join root and rest with a backslash - return 0 on success */
static int
_joinW(WCHAR *dest_path, const WCHAR *root, const WCHAR *rest)
{
size_t root_len;

if (_is_absW(rest)) {
wcscpy(dest_path, rest);
return;
return wcscpy_s(dest_path, MAX_PATH, rest);
}

root_len = wcslen(root);
if (wcscpy_s(dest_path, MAX_PATH, root)) {
return -1;
}

wcscpy(dest_path, root);
if(root_len) {
dest_path[root_len] = L'\\';
root_len++;
if (dest_path[0] && wcscat_s(dest_path, MAX_PATH, L"\\")) {
return -1;
}
wcscpy(dest_path+root_len, rest);

return wcscat_s(dest_path, MAX_PATH, rest);
}

/* join root and rest with a backslash */
static void
/* join root and rest with a backslash - return 0 on success */
static int
_joinA(char *dest_path, const char *root, const char *rest)
{
size_t root_len;

if (_is_absA(rest)) {
strcpy(dest_path, rest);
return;
return strcpy_s(dest_path, MAX_PATH, rest);
}

root_len = strlen(root);
if (strcpy_s(dest_path, MAX_PATH, root)) {
return -1;
}

strcpy(dest_path, root);
if(root_len) {
dest_path[root_len] = '\\';
root_len++;
if (dest_path[0] && strcat_s(dest_path, MAX_PATH, "\\")) {
return -1;
}
strcpy(dest_path+root_len, rest);

return strcat_s(dest_path, MAX_PATH, rest);
}

/* Return True if the path at src relative to dest is a directory */
Expand All @@ -7295,10 +7303,14 @@ _check_dirW(WCHAR *src, WCHAR *dest)
WCHAR src_resolved[MAX_PATH] = L"";

/* dest_parent = os.path.dirname(dest) */
wcscpy(dest_parent, dest);
_dirnameW(dest_parent);
if (wcscpy_s(dest_parent, MAX_PATH, dest) ||
_dirnameW(dest_parent)) {
return 0;
}
/* src_resolved = os.path.join(dest_parent, src) */
_joinW(src_resolved, dest_parent, src);
if (_joinW(src_resolved, dest_parent, src)) {
return 0;
}
return (
GetFileAttributesExW(src_resolved, GetFileExInfoStandard, &src_info)
&& src_info.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY
Expand All @@ -7314,10 +7326,14 @@ _check_dirA(char *src, char *dest)
char src_resolved[MAX_PATH] = "";

/* dest_parent = os.path.dirname(dest) */
strcpy(dest_parent, dest);
_dirnameA(dest_parent);
if (strcpy_s(dest_parent, MAX_PATH, dest) ||
_dirnameA(dest_parent)) {
return 0;
}
/* src_resolved = os.path.join(dest_parent, src) */
_joinA(src_resolved, dest_parent, src);
if (_joinA(src_resolved, dest_parent, src)) {
return 0;
}
return (
GetFileAttributesExA(src_resolved, GetFileExInfoStandard, &src_info)
&& src_info.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY
Expand Down