realpath: Do not copy result on failure (BZ #28815)

On failure, the contents of the resolved buffer passed in by the caller
to realpath are undefined.  Do not copy any partial resolution to the
buffer and also do not test resolved contents in test-canon.c.

Resolves: BZ #28815

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
(cherry picked from commit 949ad78a189194048df8a253bb31d1d11d919044)

diff --git a/NEWS b/NEWS
index cf6102582e21b22c820bbfca569639649f756b52..3a821a36fb773dcb41bd3fc9c32ebc626968cae1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -27,6 +27,7 @@ The following bugs are resolved with this release:
   [25812] Libio vtable protection is sometimes only partially enforced
   [27576] gmon: improve mcount overflow handling
   [27821] ungetc: Fix backup buffer leak on program exit
+  [28815] realpath should not copy to resolved buffer on error
   [28838] FAIL: elf/tst-p_align3
   [28846] CMSG_NXTHDR may trigger -Wstrict-overflow warning
   [28850] linux: __get_nprocs_sched reads uninitialized memory from the stack

diff --git a/stdlib/canonicalize.c b/stdlib/canonicalize.c
index 6caed9e70e14827f4320a6894a132ad4095a1065..6237a41d42bbf9596570e7d625bbbb620ada6e1c 100644 (file)
--- a/stdlib/canonicalize.c
+++ b/stdlib/canonicalize.c
@@ -400,11 +400,11 @@ realpath_stk (const char *name, char *resolved,
 
 error:
   *dest++ = '\0';
-  if (resolved != NULL)
+  if (!failed && resolved != NULL)
     {
       if (dest - rname <= get_path_max ())
        rname = strcpy (resolved, rname);
-      else if (!failed)
+      else
        {
          failed = true;
          __set_errno (ENAMETOOLONG);

diff --git a/stdlib/test-canon.c b/stdlib/test-canon.c
index 185ccf4f483108caf16ad45ee0303539b525dff9..2ad1218749dc79e25f0b4d1947c6bfbef436eb82 100644 (file)
--- a/stdlib/test-canon.c
+++ b/stdlib/test-canon.c
@@ -174,7 +174,9 @@ do_test (int argc, char ** argv)
          continue;
        }
 
-      if (!check_path (buf, tests[i].out ? tests[i].out : tests[i].resolved))
+      /* Only on success verify that buf contains the result too.  */
+      if (result != NULL
+         && !check_path (buf, tests[i].out ? tests[i].out : tests[i].resolved))
        {
          printf ("%s: flunked test %d (expected resolved `%s', got `%s')\n",
                  argv[0], i, tests[i].out ? tests[i].out : tests[i].resolved,