[jvb@cyberscience.com] libc/1788: getcwd(NULL,size) with size>0 doesn't work

[Andreas Jaeger <aj at suse dot de>]

John Buddery sent the appended bug report.  I've verified the problem
and propose the appended patch to fix this.

John, can you check the patch, please?

May I commit this?

Andreas

2000-07-13  Andreas Jaeger  <aj@suse.de>

	* sysdeps/unix/sysv/linux/getcwd.c (__getcwd): Correctly handle
	getcwd (NULL, size) with size > 0.
	Fixes PR libc/1788, reported by John Buddery
	<jvb@cyberscience.com>.


============================================================
Index: sysdeps/unix/sysv/linux/getcwd.c
--- sysdeps/unix/sysv/linux/getcwd.c	2000/07/07 02:19:05	1.14
+++ sysdeps/unix/sysv/linux/getcwd.c	2000/07/13 09:21:50
@@ -103,8 +103,9 @@
       retval = INLINE_SYSCALL (getcwd, 2, CHECK_STRING (path), alloc_size);
       if (retval >= 0)
 	{
-	  if (buf == NULL)
+	  if (buf == NULL && size == 0)
 	    {
+	      /* Ensure that the buffer is only as large as necessary.  */
 	      buf = realloc (path, (size_t) retval);
 	      if (buf == NULL)
 		/* `realloc' failed but we still have the original string.  */
@@ -115,8 +116,9 @@
 
 # if __ASSUME_GETCWD_SYSCALL
       /* It should never happen that the `getcwd' syscall failed because
-	 the buffer is too small if we allocated the buffer outself.  */
-      assert (errno != ERANGE || buf != NULL);
+	 the buffer is too small if we allocated the buffer ourselves
+	 large enough.  */
+      assert (errno != ERANGE || buf != NULL || size != 0);
 
       if (buf == NULL)
 	free (path);
@@ -153,8 +155,9 @@
 	    }
 
 	  path[n] = '\0';
-	  if (buf == NULL)
+	  if (buf == NULL && size == 0)
 	    {
+	      /* Ensure that the buffer is only as large as necessary.  */
 	      buf = realloc (path, (size_t) n + 1);
 	      if (buf == NULL)
 		/* `relloc' failed but we still have the original string.  */

Subject: Topics

Topics:
   libc/1788: getcwd(NULL,size) with size>0 doesn't work

---

• To: bugs at gnu dot org
• Subject: libc/1788: getcwd(NULL,size) with size>0 doesn't work
• From: jvb at cyberscience dot com
• Date: Thu, 22 Jun 2000 16:45:10 +0100

>Number:         1788
>Category:       libc
>Synopsis:       getcwd() with NULL buf and size >0 does not alloc size bytes
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    libc-gnats
>State:          open
>Class:          sw-bug
>Submitter-Id:   unknown
>Arrival-Date:   Thu Jun 22 14:30:02 EDT 2000
>Last-Modified:
>Originator:     John Buddery
>Organization:
 Cyberscience Corporation
>Release:        libc-2.1.2
>Environment:
	
Host type: i386-redhat-linux-gnu
System: Linux gilbern.uk.cyberscience.com 2.2.12-20smp #1 SMP Mon Sep 27 10:34:45 EDT 1999 i686 unknown
Architecture: i686

Addons: crypt glibc-compat linuxthreads
Build CFLAGS: -O3 -Wall -Winline -Wstrict-prototypes -Wwrite-strings -g
Build CC: egcs
Compiler version: egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)
Kernel headers: 2.2.12-20smp
Symbol versioning: yes
Build static: yes
Build shared: yes
Build pic-default: no
Build profile: yes
Build omitfp: no
Build bounded: no
Build static-nss: no
Stdio: libio

>Description:
	If the Linux getcwd() routine is called with a NULL buffer, it always
        returns a buffer which is only allocated as large enough for the
        result - ignoring the size argument. This is contrary to the
        documentation, and the behaviour on other systems, which state that
        if size > 0, then the returned buffer will be that large. 
>How-To-Repeat:
	
>Fix:
        In sysdeps/unix/sysv/linux/getcwd.c :

	The __getcwd() routine correctly calls malloc() with the correct size,
        but then calls realloc() later after the syscall / readlink.

        One fix is to make sure we use the allocated buffer always
        when size > 0 :

  if (size == 0)
    {
      if (buf != NULL)
        {
          __set_errno (EINVAL);
          return NULL;
        }

      alloc_size = PATH_MAX;
    }

  if (buf != NULL)
    path = buf;
  else
    {
      path = malloc (alloc_size);
      if (path == NULL)
        return NULL;
>Audit-Trail:
>Unformatted:
>>>   if (size > 0)
>>>     buf = path;
    }

---

-- 
 Andreas Jaeger
  SuSE Labs aj@suse.de
   private aj@arthur.inka.de