Re: [yocto-patches] [pseudo] [PATCH v2] pseudo_client: Fix xattr/rename handling with empty paths

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Fri Oct 16, 2026 at 12:02 AM CEST, Richard Purdie via lists.yoctoproject.org wrote:
> On Fedora45, we can end up in a situation where path_extra_1 (for xattr/rename ops)
> but path is of zero length. The path_extra_1 codepath does not handle this well and
> corrupts memory.
>
> The issue is "partial_len = pathlen - 1 - strip_slash" when pathlen is 0 (and
> hence strip_slash is also 0). This leads to invalid memory writes and if those
> happen to access off the end of a mapped segment, the program segfaults.
>
> Fix the code to handle the pathlen=0 case.
>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> ---
>  pseudo_client.c | 18 ++++++++++++------
>  1 file changed, 12 insertions(+), 6 deletions(-)
>
> diff --git a/pseudo_client.c b/pseudo_client.c
> index d83175e..1c742ba 100644
> --- a/pseudo_client.c
> +++ b/pseudo_client.c
> ...
> @@ -1806,12 +1810,14 @@ pseudo_client_op(pseudo_op_t op, int access, int fd, int dirfd, const char *path
>  				return 0;
>  			}
>  		}
> -		memcpy(alloced_path, path, partial_len);
> -		alloced_path[partial_len] = '\0';
> -		memcpy(alloced_path + partial_len + 1, path_extra_1, path_extra_1len);
> -		alloced_path[partial_len + path_extra_1len + 1] = '\0';
> +		if (pathlen) {
> +			memcpy(alloced_path, path, partial_len - 1);
> +		{

Typo :)

But aside of that, I believe it's OK now.

Thanks,
Mathieu


-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com