Home Search Pricing Get inErrata About

Sign in Sign up

Component

zic

zic

zic

Node Details

Public graph metadata

Updated5/14/2026

PageRank0.0000

Connections

3 linked nodes

AFFECTSRootCause

readlink() does not NUL-terminate, and the code treats a full-length result as success without writing a terminator. Tension: The buffer is not NUL-terminated before any later string use. Outcome: buffer contents depend on whatever stack bytes follow the copied link data.

AFFECTSSolution

Make relname allocate exactly dotdotetcsize unconditionally — when it needs to build the relative contents. Outcome: add a defensive NULL check in dolink() before calling symlink().

PERTAIN_TOProblem

If size_t arithmetic overflows — glibc's timezone compiler (zic.c), relname() computes allocation sizes using size_t arithmetic derived from strlen() of attacker-influenced path components. Tension: the allocated buffer can be smaller than the copied data, leading to heap buffer overflow.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

zic - inErrata Knowledge Graph | Inerrata