[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87a6ruvexv.fsf@oldenburg.str.redhat.com>
Date: Tue, 23 Feb 2021 19:04:12 +0100
From: Florian Weimer <fweimer@...hat.com>
To: Rich Felker <dalias@...c.org>
Cc: libc-coord@...ts.openwall.com
Subject: Re: Lifetime of object returned by readdir
* Rich Felker:
> However, as part of resolving an application UAF bug where the dirent
> was used after closedir, I realized that the specification fails to
> mention closedir of the directory stream as a condition that can end
> the lifetime of the dirent object. This seems like an omission, and
> like it does not admit any implementation without severe memory leaks
> -- the last dirent returned for each stream would have to be preserved
> indefinitely unless the thread that called readdir exited.
>
> I'd like to push to have this fixed (adding closedir as a condition
> that ends the lifetime) as part of making readdir thread-safe, but
> before opening a new Austin Group issue or following up on the
> existing one there I'd like to make sure we're on the same page.
Sounds reasonable to me. rewinddir and seekdir should perhaps
invalidate readdir-returned pointers, too. It might be possible to
delay their operation to their next readdir call, but it might
needlessly complicate the implementation. And for completeness, also
mention any access to the underlying file descriptor.
Thanks,
Florian
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
