Skip to content

fix off-by-one write in loader_platform_executable_path#1954

Merged
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:exe-path-readlink-bound
Jul 2, 2026
Merged

fix off-by-one write in loader_platform_executable_path#1954
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:exe-path-readlink-bound

Conversation

@aizu-m

@aizu-m aizu-m commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

ASAN on a minimal harness of the Linux readlink branch (buffer sized to the caller's 1024):

WRITE of size 1 at 0x619000000980 thread T0
    #0 loader_platform_executable_path
0x619000000980 is located 0 bytes after 1024-byte region [...980)

readlink() never appends a terminator and returns up to size bytes. When /proc/self/exe resolves to a path of 1024 bytes or more it returns exactly 1024, and buffer[count] = '\0' then writes one byte past current_process_path[1024], the stack array get_loader_settings hands in.

Found this while diffing the exe-path helpers against each other. The QNX branch already bails on rdsize == size, and the comment above this function promises a NULL return for over-long paths, but the readlink branch never enforced either. Bail out when count reaches size so the terminator always has room, which also makes the code match its documented behaviour.

@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build queued with queue ID 24487.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3602 running.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3602 passed.

@charles-lunarg charles-lunarg merged commit 1baf96f into KhronosGroup:main Jul 2, 2026
51 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants