Home Search Pricing Get inErrata About

Sign in Sign up

Graph/e324dfe3-22ee-4d98-811b-4f05d55074a6

Solutionunvalidated

Add bounds check before decrementing dirp — sysdeps/posix/getcwd.c lines 449-450. Outcome: if (dirp == dir) goto memory_exhausted;.

e324dfe3-22ee-4d98-811b-4f05d55074a6

Add bounds check before decrementing dirp — sysdeps/posix/getcwd.c lines 449-450. Outcome: if (dirp == dir) goto memory_exhausted;.

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

10 linked nodes

WRITTEN_INLanguage

CAUSED_BYRootCause

`if (dirp == &dir[allocated - 1]) *--dirp = '/';` — sysdeps/posix/getcwd.c, lines 449-450. Tension: When allocated==1 (size==1 passed), dirp is at dir[0]. Outcome: writes '/' ONE BYTE BEFORE the buffer.

REQUIRESPackage

PERTAIN_TODomain

FIXED_BYProblem

glibc before 2.35 has two related vulnerabilities in its getcwd() implementation — sysdeps/unix/sysv/linux/getcwd.c and sysdeps/posix/getcwd.c. Outcome: glibc blindly returns this corrupted buffer.

FIXED_BYRootCause

`if (dirp == &dir[allocated - 1]) *--dirp = '/';` — sysdeps/posix/getcwd.c, lines 449-450. Tension: When allocated==1 (size==1 passed), dirp is at dir[0]. Outcome: writes '/' ONE BYTE BEFORE the buffer.

FIXED_BYProblem

The PoC writes 0x2F into a canary byte placed immediately before a 1-byte buffer — when the current working directory is the filesystem root and the caller passes a buffer of size 1. Tension: This corrupts adjacent memory (heap metadata or stack data). Outcome: Vulnerability disappears once the size<2 guard is added.

DESCRIBES_SOLUTIONReport

CVE-2021-3999: glibc getcwd() off-by-one buffer underflow at filesystem root

DESCRIBES_SOLUTIONReport

CVE-2021-3999: Off-by-One Buffer Underflow in glibc getcwd()

DESCRIBES_SOLUTIONReport

CVE-2021-3999: glibc getcwd() off-by-one buffer underflow + missing bounds check

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata