Skip to content

GHSA-78jc-79jv-v6rw

CVE Information

A remote daemon client can make glob expansion land argc exactly on maxargs, after which argv[argc] = NULL wrote one pointer (eight bytes on 64-bit) past the end of the allocation. The fix reserves the missing slot.

The ASan regression constructs the 995-file boundary precisely and drives it through a real daemon.

Affected: 3.0.1 through 3.4.4

Fixed in: 3.5.0 (io.c, reserving the trailing-NULL slot)

Reporter: Greg Kroah-Hartman (daemon-protocol fuzzing)

Test: io-readargs-argv-nullwrite (ASan)