From 9ff7cb76509534e740d57c5bfdd708db130c98e3 Mon Sep 17 00:00:00 2001 From: Levent Kaya Date: Tue, 17 Mar 2026 14:48:07 +0300 Subject: [PATCH 1/6] unix: prevent uv__make_subdirs_p buffer overflow --- src/unix/aix.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/unix/aix.c b/src/unix/aix.c index 4c0f4adb4..af4190312 100644 --- a/src/unix/aix.c +++ b/src/unix/aix.c @@ -521,6 +521,8 @@ static int uv__make_subdirs_p(const char *filename) { char cmd[2048]; char *p; int rc = 0; + size_t cmd_len; + ptrdiff_t dir_part_len; /* Strip off the monitor file name */ p = strrchr(filename, '/'); @@ -534,6 +536,12 @@ static int uv__make_subdirs_p(const char *filename) { sprintf(cmd, "/aha/fs/modFile.monFactory"); } + cmd_len = strlen(cmd); + dir_part_len = p - filename; + + if (cmd_len + (size_t)dir_part_len + 1 > sizeof(cmd)) + return UV_ENAMETOOLONG; + strncat(cmd, filename, (p - filename)); rc = uv__makedir_p(cmd); From 5ebb71d8fbcb5834a035a48005a76b26e22f18f0 Mon Sep 17 00:00:00 2001 From: Levent Kaya Date: Tue, 17 Mar 2026 14:51:15 +0300 Subject: [PATCH 2/6] unix: prevent uv__make_subdirs_p buffer overflow --- src/unix/aix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/unix/aix.c b/src/unix/aix.c index af4190312..d99dc8fd5 100644 --- a/src/unix/aix.c +++ b/src/unix/aix.c @@ -542,7 +542,7 @@ static int uv__make_subdirs_p(const char *filename) { if (cmd_len + (size_t)dir_part_len + 1 > sizeof(cmd)) return UV_ENAMETOOLONG; - strncat(cmd, filename, (p - filename)); + strncat(cmd, filename, dir_part_len); rc = uv__makedir_p(cmd); if (rc == -1 && errno != EEXIST){ From f84afb7cc5233a56d019b95a4b0aac5e79eb92f9 Mon Sep 17 00:00:00 2001 From: Levent Kaya Date: Tue, 17 Mar 2026 15:07:04 +0300 Subject: [PATCH 3/6] unix: prevent uv__make_subdirs_p buffer overflow --- src/unix/aix.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/unix/aix.c b/src/unix/aix.c index d99dc8fd5..70a9aba7b 100644 --- a/src/unix/aix.c +++ b/src/unix/aix.c @@ -523,7 +523,6 @@ static int uv__make_subdirs_p(const char *filename) { int rc = 0; size_t cmd_len; ptrdiff_t dir_part_len; - /* Strip off the monitor file name */ p = strrchr(filename, '/'); From 4b14de5a454b2f1c0cc660d9320a036224518780 Mon Sep 17 00:00:00 2001 From: Levent Kaya Date: Wed, 18 Mar 2026 22:04:08 +0300 Subject: [PATCH 4/6] unix: check uv__make_subdirs_p UV_ENAMETOOLONG error when called --- src/unix/aix.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/unix/aix.c b/src/unix/aix.c index 70a9aba7b..faedc288a 100644 --- a/src/unix/aix.c +++ b/src/unix/aix.c @@ -576,6 +576,8 @@ static int uv__setup_ahafs(const char* filename, int *fd) { /* Make the necessary subdirectories for the monitor file */ rc = uv__make_subdirs_p(filename); + if (rc == UV_ENAMETOOLONG) + return rc; if (rc == -1 && errno != EEXIST) return rc; From 2b775c37ba55bf1658039a8529560e62655f30e4 Mon Sep 17 00:00:00 2001 From: Levent Kaya Date: Wed, 18 Mar 2026 22:06:54 +0300 Subject: [PATCH 5/6] unix: check uv__make_subdirs_p UV_ENAMETOOLONG error when called --- src/unix/aix.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/unix/aix.c b/src/unix/aix.c index faedc288a..f7ff570d7 100644 --- a/src/unix/aix.c +++ b/src/unix/aix.c @@ -576,9 +576,7 @@ static int uv__setup_ahafs(const char* filename, int *fd) { /* Make the necessary subdirectories for the monitor file */ rc = uv__make_subdirs_p(filename); - if (rc == UV_ENAMETOOLONG) - return rc; - if (rc == -1 && errno != EEXIST) + if (rc != 0) return rc; strcat(mon_file, filename); From ab07770d6b550bb8d1e4894f64810d9b3e2e9629 Mon Sep 17 00:00:00 2001 From: Levent Kaya Date: Thu, 26 Mar 2026 10:02:17 +0300 Subject: [PATCH 6/6] unix: check on uv__makedir_p --- src/unix/aix.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/unix/aix.c b/src/unix/aix.c index f7ff570d7..168e12e38 100644 --- a/src/unix/aix.c +++ b/src/unix/aix.c @@ -495,8 +495,10 @@ static int uv__makedir_p(const char *dir) { size_t len; int err; - /* TODO(bnoordhuis) Check uv__strscpy() return value. */ - uv__strscpy(tmp, dir, sizeof(tmp)); + ssize_t rc = uv__strscpy(tmp, dir, sizeof(tmp)); + if (rc == UV_E2BIG) + return UV_ENAMETOOLONG; + len = strlen(tmp); if (tmp[len - 1] == '/') tmp[len - 1] = 0;