chroot_realpath: Replace sprintf with snprintf

osamakader · osamakader · commit fc084fdfc018 · 2025-09-27T14:56:17.000+03:00
Replace sprintf with snprintf to prevent buffer overflows in
chroot_realpath.c. This follows the security hardening mentioned
in NEWS.md where sprintf was replaced with safer alternatives.

The function uses PATH_MAX as the buffer size since sizeof on
array function parameters returns the pointer size, not the
actual buffer size.

Signed-off-by: Osama Abdelkader &lt;osama.abdelkader@gmail.com&gt;
diff --git a/src/libcrun/chroot_realpath.c b/src/libcrun/chroot_realpath.c
@@ -135,7 +135,11 @@ char *chroot_realpath(const char *chroot, const char *path, char resolved_path[]
 		if (n < 0) {
 			/* If a component doesn't exist, then return what we could translate. */
 			if (errno == ENOENT) {
-				sprintf (resolved_path, "%s%s%s", got_path, path[0] == '/' || path[0] == '\0' ? "" : "/", path);
+				int ret = snprintf (resolved_path, PATH_MAX, "%s%s%s", got_path, path[0] == '/' || path[0] == '\0' ? "" : "/", path);
+				if (ret >= PATH_MAX) {
+					__set_errno(ENAMETOOLONG);
+					return NULL;
+				}
 				return resolved_path;
 			}
 			/* EINVAL means the file exists but isn't a symlink. */
