bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ensure paths fit in PATH_MAX when cleaning cache

Browse source 
If a path length exceeds the PATH_MAX value, then it gets truncated
when building the path of the file to delete. This could (in a very
unlikely case...) result in the wrong file being deleted.  Check the
path fittedin the buffer before removing files.

Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
Allan McRae 2024-01-26 17:42:08 +10:00
parent 2079f6866a
commit a6b2524762
1 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/pacman/sync.c
View file

@ -83,7 +83,11 @@ static int sync_cleandb(const char *dbpath)
}
/* build the full path */
snprintf(path, PATH_MAX, "%s%s", dbpath, dname);
len = snprintf(path, PATH_MAX, "%s%s", dbpath, dname);
if(len > PATH_MAX) {
pm_printf(ALPM_LOG_ERROR, _("could not remove %s%s: path exceeds PATH_MAX\n"),
dbpath, dname);
}
/* remove all non-skipped directories and non-database files */
if(stat(path, &buf) == -1) {
@ -211,6 +215,7 @@ static int sync_cleancache(int level)
int delete = 1;
alpm_pkg_t *localpkg = NULL, *pkg = NULL;
const char *local_name, *local_version;
size_t len;
if(strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) {
continue;
@ -239,7 +244,12 @@ static int sync_cleancache(int level)
}
/* build the full filepath */
snprintf(path, PATH_MAX, "%s%s", cachedir, ent->d_name);
len=snprintf(path, PATH_MAX, "%s%s", cachedir, ent->d_name);
if(len > PATH_MAX) {
pm_printf(ALPM_LOG_ERROR, _("skipping %s%s: path exceeds PATH_MAX\n"),
cachedir, ent->d_name);
continue;
}
/* short circuit for removing all files from cache */
if(level > 1) {