A posted project path overflows htsserver's "save settings" error messages#723
Merged
Conversation
The three sprintf(tmp[1024], ...) sites reporting a failed profile save quote a project path composed from the posted "path" and "projname" fields, neither of them bounded. A sid-authenticated save with a 1200-byte path smashes the stack buffer and takes the server down. Route them through a SET_ERRORF() that formats into a fixed buffer and absorbs the truncation once, so the message clips instead of aborting: the text comes from the client, and a quieter denial of service is no better than a loud one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
The tree the case needed came within a few bytes of macOS's PATH_MAX once /var resolves to /private/var. A symlinked hts-cache gets there instead: structcheck() lets a non-directory through, and opening winprofile.ini under it fails with ENOTDIR whatever the uid. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
htsblk_failf(), PT_Element_failf() and htsserver's format_error() all had the same body; slprintfbuff_clip() now owns it. A (void) cast on slprintfbuff() is no substitute: GCC warns through warn_unused_result. vslprintfbuff() also empties dest before formatting, so a vsnprintf that fails outright cannot leave the caller publishing uninitialized stack. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
Two of the three sites only checked that the message appeared, which the old sprintf did equally well; each now compares the rendered message against the 1023-byte clip. The failing-write branch no longer needs /dev/full either: the server runs under a file-size limit, so macOS gets the same coverage. Renumbered 86 to 89, which no other pending change claims. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
The macOS leg reached the third message with no error set at all, so the write the file-size limit was supposed to break had gone through. Build the profile by doubling a 1024-wide printf, assert its length, and assert the init file came out short, so a limit that does not bite names itself instead of surfacing as a missing message. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
That is what broke the macOS leg: TMPDIR there resolves through the /var symlink, so the 1020-byte init file the third case opens was really 1028 bytes to the kernel and the open failed with ENAMETOOLONG. Both cases sit within a few bytes of macOS's 1024-byte PATH_MAX, so the paths have to be measured after resolution. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
…ror-overflow Signed-off-by: Xavier Roche <roche@httrack.com> # Conflicts: # tests/Makefile.am
…ror-overflow # Conflicts: # tests/Makefile.am
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@/tmp/claude-1000/-home-roche-git-httrack/69a76f53-3fa0-48b8-8d80-3bba01229b92/scratchpad/pr723-body.md