[Dhanu-dynamic]

KillGhostLink() in libpromises/files_links.c and LinkCopy() in
cf-agent/verify_files_utils.c reconstruct the absolute target of a relative
symbolic link by appending the readlink() result onto the link's directory
name in a CF_BUFSIZE stack buffer:

// files_links.c, linkpath is char[CF_BUFSIZE]
strcat(linkpath, linkbuf);

// verify_files_utils.c, vbuff is char[CF_BUFSIZE]
strncat(vbuff, linkbuf, CF_BUFSIZE - 1);

The strcat() is unbounded, and the strncat() third argument is the maximum
number of bytes to take from the source, not the space left in vbuff, so it
does not bound the destination either. readlink() returns up to CF_BUFSIZE-1
bytes, so a symlink whose relative target is near CF_BUFSIZE, placed by an
unprivileged user in any directory a root files promise walks (depth_search,
perms, or a link-type copy), overflows the agent's stack. KillGhostLink()
runs on every symlink met during a recursive descent, before the dead-link
stat(), so reaching it only takes one such link under a recursive promise.

Bound both appends with strlcat(..., sizeof(buf)), the same way ExpandLinks()
in files_links.c already bounds this exact operation, and have KillGhostLink()
bail out with an "Internal limit reached" message when the target does not
fit. Valid links are unchanged.

Verified with AddressSanitizer via a regression test in
tests/unit/files_links_test.c: a relative symlink with a CF_BUFSIZE-sized
target aborts KillGhostLink() with a stack overflow before the change and
returns cleanly after it.

[cf-bottom]

Thanks for submitting a pull request! Maybe @craigcomstock can review this?

[larsewi]

Thanks 🚀 A few notes:

A link target too long is silently truncated. The truncated path could produce an absolute link pointing to somewhere else (unintended). It would be safer to fail with error.

The unit test fails on macOS, because it rejects too long targets. Maybe you can skip if symlink() sets errno to ENAMETOOLONG?

[Dhanu-dynamic]

Agreed, a truncated target could end up as a valid absolute link pointing somewhere unintended. LinkCopy() now records a failure and returns PROMISE_RESULT_FAIL when the rebuilt absolute target doesn't fit, and it checks the copy back into linkbuf as well, since the old strlcpy(..., CF_BUFSIZE - 1) into a CF_BUFSIZE - 1 buffer could still drop the last byte. KillGhostLink() already bails out with an error. The test now returns early when symlink() fails with ENAMETOOLONG, as it does on macOS, and asserts on any other errno.

[larsewi]

@cf-bottom Jenkins please :) @Dhanu-dynamic can you please squash the two commits?

[cf-bottom]

Sure, I triggered a build:

Jenkins: https://ci.cfengine.com/job/pr-pipeline/15003/

Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-15003/