Commit ed80625
committed
deps: backport f617ccc644 from uv upstream
protect against realpath(3) exploit
ref: isaacs/node-glob#259 (comment)
Original commit message:
unix: error on realpath if PATH_MAX is undefined
Currently when PATH_MAX is undefined realpath will default to using 4096.
There is a potential stack overflow attack that can be mitigated by having
PATH_MAX defined. This change conservatively errors if a system does not
have PATH_MAX defined.
This change also explicitly includes `limits.h` to ensure that all platforms
have PATH_MAX defined if it is available.
Ref: http://pubs.opengroup.org/onlinepubs/9699919799/functions/realpath.html
Refs: nodejs#2680 (comment)
PR-URL: nodejs#843
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Saúl Ibarra Corretgé <[email protected]>1 parent 983a809 commit ed80625
1 file changed
+2
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
33 | 33 | | |
34 | 34 | | |
35 | 35 | | |
| 36 | + | |
36 | 37 | | |
37 | 38 | | |
38 | 39 | | |
| |||
383 | 384 | | |
384 | 385 | | |
385 | 386 | | |
386 | | - | |
| 387 | + | |
387 | 388 | | |
388 | 389 | | |
389 | 390 | | |
| |||
0 commit comments