Skip to content

fix: v0.5.38 — realpath buffer overflow in cmd_init on ubuntu-22.04 #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SoundMatt merged 2 commits into from
Jul 26, 2026
Merged

fix: v0.5.38 — realpath buffer overflow in cmd_init on ubuntu-22.04 #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cdda783
fix: v0.5.38 — realpath buffer overflow in cmd_init on ubuntu-22.04
SoundMatt Jul 26, 2026
b04674d
fix: add _GNU_SOURCE guard to cmd_init.c for realpath declaration
SoundMatt Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,16 @@ and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.

## [Unreleased]

## v0.5.38 — 2026-07-26

### Fixed
- **[P0] realpath buffer too small in cmd_init** — replaced `char resolved[512]` with
`realpath(dir, NULL)` (dynamic allocation) to fix glibc `_FORTIFY_SOURCE=2` abort on
ubuntu-22.04. `__realpath_chk` requires the destination buffer to be at least `PATH_MAX`
(4096 bytes); the 512-byte stack buffer triggered `*** buffer overflow detected ***`
during `cfusa init --docs --dir <path>` (test_init_docs_generates_templates), aborting
all remaining CLI tests in the Release CI build.

## v0.5.37 — 2026-07-26

### Fixed
Expand Down
8 changes: 6 additions & 2 deletions cmd/cfusa/cmd_init.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
#if defined(__linux__) || defined(__unix__)
# define _GNU_SOURCE
#endif
#include <stdio.h>
#include <string.h>
#include <getopt.h>
Expand Down Expand Up @@ -59,11 +62,12 @@
char dir_basename[256] = "project";
if (!project) {
const char *abs = dir;
char resolved[512];
if (realpath(dir, resolved)) abs = resolved;
char *resolved = realpath(dir, NULL);
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
if (resolved) abs = resolved;
const char *slash = strrchr(abs, '/');
strncpy(dir_basename, slash ? slash + 1 : abs, sizeof(dir_basename) - 1);
project = dir_basename;
free(resolved);

Check warning

Code scanning / cfusa

dynamic memory allocation ('free') — MISRA-C 2012 Rule 21.3: heap usage prohibited in safety-critical code Warning

dynamic memory allocation ('free') — MISRA-C 2012 Rule 21.3: heap usage prohibited in safety-critical code

Check notice

Code scanning / cfusa

CWE-416: free() call — ensure pointer is set to NULL immediately after and not referenced again (use-after-free prevention) Note

CWE-416: free() call — ensure pointer is set to NULL immediately after and not referenced again (use-after-free prevention)
}

cfusa_config_t cfg;
Expand Down
4 changes: 2 additions & 2 deletions include/cfusa/version.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@

#define CFUSA_VERSION_MAJOR 0
#define CFUSA_VERSION_MINOR 5
#define CFUSA_VERSION_PATCH 36
#define CFUSA_VERSION_STRING "0.5.37"
#define CFUSA_VERSION_PATCH 38
#define CFUSA_VERSION_STRING "0.5.38"
#define CFUSA_SCHEMA_VERSION "1.10.4"
#define CFUSA_SPEC_VERSION "1.10.4"

Expand Down
Loading