Rule Definition
The realpath function is used to determine the canonical, absolute pathname from a given pathname. In several realpath implementations an off-by-one error exists in a portion of realpath that computes the length of the resolved pathname. As a result, if the resolved path name is exactly 1024 characters long and contains at least two directory separators, the buffer passed to realpath will be overwritten by a single NULL byte. As a result applications using realpath may be vulnerable to denial of service attacks, remote code execution, and/or privilege escalation. Also insufficient buffer space supplied to the realpath function can lead to buffer overflow vulnerabilities and allows remote attackers to execute code thru it.