[vim/vim] f_resolve: readlink returning MAXPATHL then add_pathsep writes one byte past the MAXPATHL+1 buffer (Issue #20825)

2 views

Skip to first unread message

Shixin Tan

unread,

Jul 23, 2026, 6:02:47 AM (yesterday) Jul 23

to vim/vim, Subscribed

tsx543 created an issue (vim/vim#20825)

Steps to reproduce

Build Unix Vim with HAVE_READLINK (normal on Linux/BSD/macOS Unix builds; not the Windows shortcut path).
Create a symlink whose readlink() target length is exactly MAXPATHL bytes (or otherwise causes readlink(..., MAXPATHL) to return MAXPATHL).
Call resolve() on that symlink name with a trailing path separator, e.g. echo resolve('symlink/'), so has_trailing_pathsep is set and remain == NULL.
After buf[len] = NUL with len == MAXPATHL, add_pathsep(buf) appends PATHSEPSTR starting at offset MAXPATHL, writing the separator NUL one byte past the alloc(MAXPATHL + 1) buffer.
Relevant code in current master (src/filepath.c):

buf = alloc(MAXPATHL + 1);
...
len = readlink((char *)p, (char *)buf, MAXPATHL);
if (len <= 0)
    break;
buf[len] = NUL;
if (remain == NULL && has_trailing_pathsep)
    add_pathsep(buf);

void
add_pathsep(char_u *p)
{
    size_t  plen;
    if (*p == NUL)
        return;
    plen = STRLEN(p);
    if (!after_pathsep(p, p + plen))
        STRCPY(p + plen, PATHSEPSTR);   /* writes at plen and plen+1 */
}

When plen == MAXPATHL, STRCPY writes past the last allocated byte.

Expected behaviour

add_pathsep() must not write beyond the allocated buffer. If readlink already filled MAXPATHL bytes (plus the terminator at buf[MAXPATHL]), either skip appending a separator, grow/reallocate, or fail safely with an error.

Version of Vim

9.2.0838

Environment

Operating system: Linux
Terminal: any
Value of $TERM: any
Shell: any

Logs and stack traces

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.

Christian Brabandt

unread,

Jul 23, 2026, 6:04:02 AM (yesterday) Jul 23

to vim/vim, Subscribed

chrisbra left a comment (vim/vim#20825)

it seems you are creating a bunch of issues using AI. Can you please go ahead and instead create PRs for each of the issues?