New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bpo-33001: Minimal fix to prevent buffer overrun in os.symlink #5989

Merged

zooba merged 3 commits into python:master from zooba:symlink-bug

Mar 5, 2018

+73 −28

Member

zooba commented Mar 5, 2018 •

edited by bedevere-bot

https://bugs.python.org/issue33001


        Minimal fix to prevent buffer overrun in os.symlink

f31f9b4

zooba added type-bugfix needs backport to 3.6 type-security OS-windows needs backport to 3.7 labels

bedevere-bot added the awaiting merge label

the-knights-who-say-ni added the CLA signed label

zooba changed the title ~~Minimal fix to prevent buffer overrun in os.symlink~~ bpo-33001: Minimal fix to prevent buffer overrun in os.symlink


        Add NEWS entry

645312c

bedevere-bot commented Mar 5, 2018

GH-5990 is a backport of this pull request to the 3.6 branch.

bedevere-bot removed the needs backport to 3.6 label

zooba self-assigned this

izbyshev reviewed

Lib/test/test_os.py Outdated

  
                    # overflow dest with relative src

                    (segment, path),

                    # overflow dest when appending '\\' for join

                    (segment, path[:261]),

izbyshev Mar 5, 2018

Contributor

FWIW, this won't overflow when appending \\ because:

len(path[:261]) > MAX_PATH - 1, so it'll overflow in the very beginning of _check_dirW
even if len was equal to MAX_PATH - 1, _dirnameW would be applied first, making it shorter.


        Remove invalid test

e47b787

zooba merged commit 6921e73 into python:master

4 checks passed

4 checks passed

bedevere/issue-number Issue number 33001 found

Details

bedevere/news News entry found in Misc/NEWS.d

continuous-integration/appveyor/pr AppVeyor build succeeded

Details

continuous-integration/travis-ci/pr The Travis CI build passed

Details

miss-islington commented Mar 5, 2018

Thanks @zooba for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

bedevere-bot removed the awaiting merge label

zooba added a commit that referenced this pull request


        [3.6] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) (GH-5990

baa4507

zooba deleted the zooba:symlink-bug branch

bedevere-bot commented Mar 5, 2018

GH-5996 is a backport of this pull request to the 3.7 branch.

miss-islington added a commit to miss-islington/cpython that referenced this pull request


        bpo-33001: Prevent buffer overrun in os.symlink (pythonGH-5989)

e17cd84

(cherry picked from commit 6921e73)

Co-authored-by: Steve Dower <steve.dower@microsoft.com>

bedevere-bot removed the needs backport to 3.7 label

miss-islington added a commit that referenced this pull request


        bpo-33001: Prevent buffer overrun in os.symlink (GH-5989)

96fdbac

(cherry picked from commit 6921e73)

Co-authored-by: Steve Dower <steve.dower@microsoft.com>

jo2y added a commit to jo2y/cpython that referenced this pull request


        bpo-33001: Prevent buffer overrun in os.symlink (pythonGH-5989)

d4f5cf8

larryhastings added a commit that referenced this pull request


        [3.4] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) (#5992)

77c02cd

* bpo-33001: Minimal fix to prevent buffer overrun in os.symlink

* Skips test to avoid crashing during the test suite

* Remove invalid test

larryhastings added a commit that referenced this pull request


        [3.5] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) (#5991)

f381cfe

* bpo-33001: Minimal fix to prevent buffer overrun in os.symlink

* Remove invalid test

yahya-abou-imran added a commit to yahya-abou-imran/cpython that referenced this pull request


        bpo-33001: Prevent buffer overrun in os.symlink (pythonGH-5989)

0e2a565

vidartf mentioned this pull request

bpo-31512: Add non-elevated symlink support for dev mode Windows 10 #3652

Merged

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

You can’t perform that action at this time.