Skip to content

Fix buffer overflow in resolve_full_path - #997

Open
buzz wants to merge 2 commits into
dethrace-labs:mainfrom
buzz:fix/buffer-overflow
Open

Fix buffer overflow in resolve_full_path#997
buzz wants to merge 2 commits into
dethrace-labs:mainfrom
buzz:fix/buffer-overflow

Conversation

@buzz

@buzz buzz commented Apr 19, 2026

Copy link
Copy Markdown
Contributor

The resolve_full_path() function in src/harness/os/linux.c and src/harness/os/macos.c uses a static buffer _program_name[1024], but calls getcwd(path, PATH_MAX) where PATH_MAX is 4096 on Linux. This causes getcwd() to write up to 4096 bytes into a 1024-byte buffer, triggering a stack buffer overflow.

The crash is detected by glibc's _FORTIFY_SOURCE=3 protection.

@dethrace-labs

Copy link
Copy Markdown
Owner

In addition to the change suggested here, should we also be defining _program_name with the right size macro to make sure we declare a buffer thats actually big enough?

@buzz
buzz force-pushed the fix/buffer-overflow branch from 3733b23 to 267440c Compare August 20, 2026 11:43
@github-actions

Copy link
Copy Markdown

reccmp report


Saved diff report generated August 18 2026, 13:16:35 (1 day, 22:29:16 ago)


Total effective accuracy 96.45% across 2387 functions (96.08% actual accuracy)
13 functions are aligned (0.54%)

@buzz

buzz commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

In addition to the change suggested here, should we also be defining _program_name with the right size macro to make sure we declare a buffer thats actually big enough?

Good catch. Done in 267440c.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants