Skip to content

Fix path_info_len underflow in manage-script-name with trailing-slash mountpoints#2774

Open
niol wants to merge 1 commit into
unbit:masterfrom
niol:mountpoints-underflow
Open

Fix path_info_len underflow in manage-script-name with trailing-slash mountpoints#2774
niol wants to merge 1 commit into
unbit:masterfrom
niol:mountpoints-underflow

Conversation

@niol

@niol niol commented May 28, 2026

Copy link
Copy Markdown
Contributor

(see https://bugs.debian.org/1133977)

When a request path like /footris exactly matches a mountpoint /footris/ (after stripping the trailing slash for comparison), the manage-script-name code sets script_name_len to 9 (the original mountpoint length including the slash) but orig_path_info_len is only 8. The subtraction orig_path_info_len - script_name_len = -1 wraps to 65535 when stored in the uint16_t path_info_len field. Subsequent code then passes iov_len=65535 to PyUnicode_DecodeLatin1, which reads far past the end of the allocated buffer. On s390x this read crosses into an unmapped page and causes a segfault.

Fix: when orig_path_info_len is less than script_name_len (the only case being the exact-match-without-trailing-slash scenario described above), set path_info to an empty string (pointing at the end of the original path_info buffer) with path_info_len = 0.

… mountpoints

When a request path like /footris exactly matches a mountpoint /footris/
(after stripping the trailing slash for comparison), the manage-script-name
code sets script_name_len to 9 (the original mountpoint length including the
slash) but orig_path_info_len is only 8.  The subtraction
orig_path_info_len - script_name_len = -1 wraps to 65535 when stored in the
uint16_t path_info_len field.  Subsequent code then passes iov_len=65535 to
PyUnicode_DecodeLatin1, which reads far past the end of the allocated buffer.
On s390x this read crosses into an unmapped page and causes a segfault.

Fix: when orig_path_info_len is less than script_name_len (the only case
being the exact-match-without-trailing-slash scenario described above), set
path_info to an empty string (pointing at the end of the original path_info
buffer) with path_info_len = 0.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants