bpo-33001: Minimal fix to prevent buffer overrun in os.symlink by zooba · Pull Request #5989

bpo-33001: Minimal fix to prevent buffer overrun in os.symlink by zooba · Pull Request #5989 · python/cpython

Conversation

zooba changed the title ~~Minimal fix to prevent buffer overrun in os.symlink~~ bpo-33001: Minimal fix to prevent buffer overrun in os.symlink

		# overflow dest with relative src
		(segment, path),
		# overflow dest when appending '\\' for join
		(segment, path[:261]),

The reason will be displayed to describe this comment to others. Learn more.

FWIW, this won't overflow when appending \\ because:

len(path[:261]) > MAX_PATH - 1, so it'll overflow in the very beginning of _check_dirW
even if len was equal to MAX_PATH - 1, _dirnameW would be applied first, making it shorter.

Thanks @zooba for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

zooba added a commit that referenced this pull request

zooba deleted the symlink-bug branch

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

(cherry picked from commit 6921e73)

Co-authored-by: Steve Dower <steve.dower@microsoft.com>

miss-islington added a commit that referenced this pull request

(cherry picked from commit 6921e73)

Co-authored-by: Steve Dower <steve.dower@microsoft.com>

jo2y pushed a commit to jo2y/cpython that referenced this pull request

larryhastings pushed a commit that referenced this pull request

* bpo-33001: Minimal fix to prevent buffer overrun in os.symlink

* Skips test to avoid crashing during the test suite

* Remove invalid test

larryhastings pushed a commit that referenced this pull request

* bpo-33001: Minimal fix to prevent buffer overrun in os.symlink

* Remove invalid test