[PATCH] sftp-realpath: fix stack buffer over-read on empty symlink target

[Damien Miller]

applied, thanks

On Thu, 29 Oct 2026, jelly via openssh-unix-dev wrote:

> From: immortal-jelly <xuehaolin at uniontech.com>
> 
> readlink(2) can return 0 when a symbolic link resolves to an empty
> string.  In sftp_realpath() the result is used unconditionally a few
> lines later:
> 
> if (symlink[slen - 1] != '/')
> 
> which reads one byte before the start of the symlink[] stack buffer
> when slen is zero.  An authenticated SFTP user can create a link with
> an empty target and trigger this path with a REALPATH request.
> 
> Treat a zero-length link target as a broken link and fail with ENOENT
> before the buffer is used.
> 
> Reported via GitHub issue #721.
> ---
>  sftp-realpath.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/sftp-realpath.c b/sftp-realpath.c
> index 2ec779d8..4fcde6d5 100644
> --- a/sftp-realpath.c
> +++ b/sftp-realpath.c
> @@ -173,6 +173,11 @@ sftp_realpath(const char *path, char *resolved)
>   slen = readlink(resolved, symlink, sizeof(symlink) - 1);
>   if (slen < 0)
>   goto err;
> + if (slen == 0) {
> + /* empty symlink target is a broken link */
> + errno = ENOENT;
> + goto err;
> + }
>   symlink[slen] = '\0';
>   if (symlink[0] == '/') {
>   resolved[1] = 0;
> --
> 2.20.1
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>