From 4a8e0c84470a89611764e09d1918609305a3f23d Mon Sep 17 00:00:00 2001 From: J-P Nurmi Date: Sat, 5 Sep 2026 12:18:32 +0200 Subject: [PATCH 1/4] fix(native): validate buffer attachment paths Reject generated paths whose direct parent is not the UUID run directory while preserving attachment filenames. --- src/backends/sentry_backend_native.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/src/backends/sentry_backend_native.c b/src/backends/sentry_backend_native.c index 74156e1af..305dd2c04 100644 --- a/src/backends/sentry_backend_native.c +++ b/src/backends/sentry_backend_native.c @@ -1252,13 +1252,20 @@ ensure_attachment_path(sentry_attachment_t *attachment) return false; } - sentry_path_t *old_path = attachment->path; - attachment->path = sentry__path_join_str( + sentry_path_t *path = sentry__path_join_str( base_path, sentry__path_filename(attachment->filename)); - + sentry_path_t *parent = path ? sentry__path_dir(path) : NULL; + bool valid = parent && sentry__path_eq(parent, base_path); + sentry__path_free(parent); sentry__path_free(base_path); - sentry__path_free(old_path); - return attachment->path != NULL; + if (!valid) { + sentry__path_free(path); + return false; + } + + sentry__path_free(attachment->path); + attachment->path = path; + return true; } static void From 7d151da69b9e125b229884ca49ab52c6fc9c501a Mon Sep 17 00:00:00 2001 From: J-P Nurmi Date: Sat, 5 Sep 2026 12:26:18 +0200 Subject: [PATCH 2/4] Update CHANGELOG.md --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6d5d1927c..b6fd64829 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,7 @@ - Guard size arithmetic when parsing envelopes and Linux OS release data, copying slices, and allocating memory during crash handling. ([#2059](https://github.com/getsentry/sentry-native/pull/2059)) - macOS: prevent out-of-bounds reads while parsing Mach-O load commands. ([#2065](https://github.com/getsentry/sentry-native/pull/2065)) - Prevent out-of-bounds reads when parsing JSON numbers from length-delimited buffers. ([#2067](https://github.com/getsentry/sentry-native/pull/2067)) +- Native: prevent buffer attachments from being written outside their UUID run directory. ([#2072](https://github.com/getsentry/sentry-native/pull/2072)) **Thank you**: From 2295e0f43a7842fb55183c2c71f1c446efdc8b27 Mon Sep 17 00:00:00 2001 From: J-P Nurmi Date: Sat, 5 Sep 2026 13:04:02 +0200 Subject: [PATCH 3/4] validate first --- src/backends/sentry_backend_native.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/backends/sentry_backend_native.c b/src/backends/sentry_backend_native.c index 305dd2c04..5d6af14b1 100644 --- a/src/backends/sentry_backend_native.c +++ b/src/backends/sentry_backend_native.c @@ -1247,8 +1247,7 @@ ensure_attachment_path(sentry_attachment_t *attachment) } } - if (!base_path || sentry__path_create_dir_all(base_path) != 0) { - sentry__path_free(base_path); + if (!base_path) { return false; } @@ -1257,12 +1256,13 @@ ensure_attachment_path(sentry_attachment_t *attachment) sentry_path_t *parent = path ? sentry__path_dir(path) : NULL; bool valid = parent && sentry__path_eq(parent, base_path); sentry__path_free(parent); - sentry__path_free(base_path); - if (!valid) { + if (!valid || sentry__path_create_dir_all(base_path) != 0) { sentry__path_free(path); + sentry__path_free(base_path); return false; } + sentry__path_free(base_path); sentry__path_free(attachment->path); attachment->path = path; return true; From f433e2cc692d4a1b2c88f5616989ed742d74b12c Mon Sep 17 00:00:00 2001 From: J-P Nurmi Date: Mon, 7 Sep 2026 12:07:00 +0200 Subject: [PATCH 4/4] reject empty --- src/backends/sentry_backend_native.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/backends/sentry_backend_native.c b/src/backends/sentry_backend_native.c index ce152cf54..0061f63d0 100644 --- a/src/backends/sentry_backend_native.c +++ b/src/backends/sentry_backend_native.c @@ -1260,6 +1260,11 @@ ensure_attachment_path(sentry_attachment_t *attachment) return false; } + const char *filename = sentry__path_filename(attachment->filename); + if (sentry__string_empty(filename)) { + return false; + } + // Generate UUID for unique path sentry_uuid_t uuid = sentry_uuid_new_v4(); char uuid_str[37]; @@ -1276,8 +1281,7 @@ ensure_attachment_path(sentry_attachment_t *attachment) return false; } - sentry_path_t *path = sentry__path_join_str( - base_path, sentry__path_filename(attachment->filename)); + sentry_path_t *path = sentry__path_join_str(base_path, filename); sentry_path_t *parent = path ? sentry__path_dir(path) : NULL; bool valid = parent && sentry__path_eq(parent, base_path); sentry__path_free(parent);