镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

[rcore] Fix GetDirectoryPath() and GetPrevDirectoryPath() buffer overflow on long paths - #6340

Closed
emincan2000 wants to merge 1 commit into
raysan5:masterfrom
emincan2000:fix-getdirectorypath-overflow
Closed

emincan2000 wants to merge 1 commit into
raysan5:masterfrom
emincan2000:fix-getdirectorypath-overflow

Conversation

@emincan2000

Copy link
Copy Markdown
Contributor

Both copy into a static MAX_FILEPATH_LENGTH buffer without checking the length, so a path of around 4096 chars writes past the end (ASan global-buffer-overflow). On Windows MAX_FILEPATH_LENGTH is only 260, so it's a lot easier to hit there. GetDirectoryPath("") also reads filePath[1], one byte past the string.

The copy is now capped to the buffer size. I put the relative path check in a variable since it was written out three times. Normal paths give the same result as before, I compared 20k random paths against the old build.

@raysan5

raysan5 commented Oct 28, 2026

Copy link
Copy Markdown
Owner

@emincan2000 It seems you used same AI than #6331

Please, next time check the open PRs... did you even try raylib?

@emincan2000

Copy link
Copy Markdown
Contributor Author

You're right, sorry about that. I ran into it while testing the path functions with long paths under ASan and didn't look through the open PRs first, #6331 already covers it. Closing this one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants