From 5aca48b16e7212a20b0ff850b1ca7afb431dabf1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C5=8Dshin?= Date: Mon, 18 Dec 2023 22:46:07 -0500 Subject: [PATCH] Fix buffer overflow in TryPath Missed this when changing the code back to be like the old version. com is now a parameter. The only plausible way to trigger this would be to pass a loader pathname close to MAX_PATH characters long, and then remove that path prior to the first sys_faccessat. --- libc/calls/getprogramexecutablename.greg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libc/calls/getprogramexecutablename.greg.c b/libc/calls/getprogramexecutablename.greg.c index 17d270ad4..5d3c576b5 100644 --- a/libc/calls/getprogramexecutablename.greg.c +++ b/libc/calls/getprogramexecutablename.greg.c @@ -98,6 +98,7 @@ static int TryPath(const char *q, int com) { } *p = 0; if (!sys_faccessat(AT_FDCWD, g_prog.u.buf, F_OK, 0)) return 1; + if (!com) return 0; p = WRITE32LE(p, READ32LE(".com")); *p = 0; if (!sys_faccessat(AT_FDCWD, g_prog.u.buf, F_OK, 0)) return 1;