[XPCOM] Deal with lstat potentially lying in nsLocalFileUnix.

This commit is contained in:
Moonchild 2022-11-19 20:11:34 +00:00 • committed by roytam1
commit dc04d9f795

View file

@ -1720,11 +1720,14 @@ nsLocalFile::GetNativeTarget(nsACString& aResult)
return NS_ERROR_OUT_OF_MEMORY; return NS_ERROR_OUT_OF_MEMORY;
} }
if (readlink(mPath.get(), target, (size_t)size) < 0) { ssize_t written = readlink(mPath.get(), target.BeginWriting(), size_t(size));
if (written < 0) {
free(target); free(target);
return NSRESULT_FOR_ERRNO(); return NSRESULT_FOR_ERRNO();
} }
target[size] = '\0'; // Target might have changed since the lstat call, or lstat might lie, see bug
// 1791029.
target.Truncate(written);
nsresult rv = NS_OK; nsresult rv = NS_OK;
nsCOMPtr<nsIFile> self(this); nsCOMPtr<nsIFile> self(this);
@ -1775,12 +1778,15 @@ nsLocalFile::GetNativeTarget(nsACString& aResult)
size = newSize; size = newSize;
} }
int32_t linkLen = readlink(flatRetval.get(), target, size); ssize_t linkLen = readlink(flatRetval.get(), target, size);
if (linkLen == -1) { if (linkLen == -1) {
rv = NSRESULT_FOR_ERRNO(); rv = NSRESULT_FOR_ERRNO();
break; break;
} }
target[linkLen] = '\0'; // Target might have changed since the lstat call, or lstat might lie, see bug
// 1791029.
newTarget.Truncate(linkLen);
target = newTarget;
} }
free(target); free(target);