[PATCH] sftp-realpath: fix stack buffer over-read on empty symlink target

[jelly]

From: immortal-jelly <xuehaolin at uniontech.com>

readlink(2) can return 0 when a symbolic link resolves to an empty
string.  In sftp_realpath() the result is used unconditionally a few
lines later:

if (symlink[slen - 1] != '/')

which reads one byte before the start of the symlink[] stack buffer
when slen is zero.  An authenticated SFTP user can create a link with
an empty target and trigger this path with a REALPATH request.

Treat a zero-length link target as a broken link and fail with ENOENT
before the buffer is used.

Reported via GitHub issue #721.
---
 sftp-realpath.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sftp-realpath.c b/sftp-realpath.c
index 2ec779d8..4fcde6d5 100644
--- a/sftp-realpath.c
+++ b/sftp-realpath.c
@@ -173,6 +173,11 @@ sftp_realpath(const char *path, char *resolved)
  slen = readlink(resolved, symlink, sizeof(symlink) - 1);
  if (slen < 0)
  goto err;
+ if (slen == 0) {
+ /* empty symlink target is a broken link */
+ errno = ENOENT;
+ goto err;
+ }
  symlink[slen] = '\0';
  if (symlink[0] == '/') {
  resolved[1] = 0;
--
2.20.1