From e62148b5f59c618970fda2c699fae3a9187e324c Mon Sep 17 00:00:00 2001 From: Wesley Hershberger Date: Thu, 24 Sep 2026 19:13:56 -0500 Subject: [PATCH] Fix buffer overflow in readEnvPipe readEnvPipe writes a null terminator to buffer[sz] without a bounds check; if a write was >1024 the write overflows the buffer. Signed-off-by: Wesley Hershberger --- src/leader.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/leader.cpp b/src/leader.cpp index fccb7f1..505ff85 100644 --- a/src/leader.cpp +++ b/src/leader.cpp @@ -34,6 +34,8 @@ #include "run.h" +const int SET_ENV_BUF_SIZE = 1024; + // short syntax helper for kj::Path template inline kj::Path operator/(const kj::Path& p, const T& ext) { @@ -131,7 +133,7 @@ Leader::Leader(kj::AsyncIoContext &ioContext, kj::Filesystem &fs, const char *jo LSYSCALL(pipe(setEnvPipe)); auto event = ioContext.lowLevelProvider->wrapInputFd(setEnvPipe[0], kj::LowLevelAsyncIoProvider::TAKE_OWNERSHIP); - auto buffer = kj::heapArrayBuilder(1024); + auto buffer = kj::heapArrayBuilder(SET_ENV_BUF_SIZE); tasks.add(readEnvPipe(event, buffer.asPtr().begin()).attach(kj::mv(event), kj::mv(buffer))); } @@ -295,7 +297,7 @@ kj::Promise Leader::reapChildProcesses() } kj::Promise Leader::readEnvPipe(kj::AsyncInputStream *stream, char *buffer) { - return stream->tryRead(buffer, 1, 1024).then([this,stream,buffer](size_t sz) { + return stream->tryRead(buffer, 1, SET_ENV_BUF_SIZE - 1).then([this,stream,buffer](size_t sz) { if(sz > 0) { buffer[sz] = '\0'; if(char* eq = strchr(buffer, '=')) {