Skip to content

Commit ed80625

Browse files
committed
deps: backport f617ccc644 from uv upstream
protect against realpath(3) exploit ref: isaacs/node-glob#259 (comment) Original commit message: unix: error on realpath if PATH_MAX is undefined Currently when PATH_MAX is undefined realpath will default to using 4096. There is a potential stack overflow attack that can be mitigated by having PATH_MAX defined. This change conservatively errors if a system does not have PATH_MAX defined. This change also explicitly includes `limits.h` to ensure that all platforms have PATH_MAX defined if it is available. Ref: http://pubs.opengroup.org/onlinepubs/9699919799/functions/realpath.html Refs: nodejs#2680 (comment) PR-URL: nodejs#843 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Saúl Ibarra Corretgé <[email protected]>
1 parent 983a809 commit ed80625

File tree

1 file changed

+2
-1
lines changed
  • deps/uv/src/unix

1 file changed

+2
-1
lines changed

deps/uv/src/unix/fs.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
#include <stdio.h>
3434
#include <stdlib.h>
3535
#include <string.h>
36+
#include <limits.h> /* PATH_MAX */
3637

3738
#include <sys/types.h>
3839
#include <sys/socket.h>
@@ -383,7 +384,7 @@ static ssize_t uv__fs_pathmax_size(const char* path) {
383384
#if defined(PATH_MAX)
384385
return PATH_MAX;
385386
#else
386-
return 4096;
387+
#error "PATH_MAX undefined in the current platform"
387388
#endif
388389
}
389390

0 commit comments

Comments
 (0)