From 2d43f8443d17da4b16208688259441c06e1ca515 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 6 Jan 2026 00:58:45 +0000 Subject: [PATCH 1/2] Initial plan From d6ee4f96c31738dc8453fddfbcb695865e72ba11 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 6 Jan 2026 01:34:31 +0000 Subject: [PATCH 2/2] Fix segfault when TMPDIR contains format specifiers Co-authored-by: steveisok <471438+steveisok@users.noreply.github.com> --- src/coreclr/pal/src/thread/process.cpp | 29 +++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/src/coreclr/pal/src/thread/process.cpp b/src/coreclr/pal/src/thread/process.cpp index 129c883d522d5d..4d968e64e79dd1 100644 --- a/src/coreclr/pal/src/thread/process.cpp +++ b/src/coreclr/pal/src/thread/process.cpp @@ -2026,14 +2026,37 @@ PAL_GetTransportName( } } - if (strncat_s(formatBuffer, MAX_TRANSPORT_NAME_LENGTH, IpcNameFormat, strlen(IpcNameFormat)) == STRUNCATE) + // Format the IPC name into a temporary buffer to avoid treating the temp path as a format string. + // This prevents issues when TMPDIR contains format specifiers (e.g., "/tmp/%d"). + PathCharString ipcNameString; + char *ipcName = ipcNameString.OpenStringBuffer(MAX_TRANSPORT_NAME_LENGTH-1); + if (ipcName == nullptr) + { + ERROR("Out Of Memory"); + return; + } + + int chars = snprintf(ipcName, MAX_TRANSPORT_NAME_LENGTH, IpcNameFormat, prefix, id, disambiguationKey, suffix); + if (chars < 0 || (unsigned int)chars >= MAX_TRANSPORT_NAME_LENGTH) + { + ERROR("IPC name formatting failed or was too large"); + return; + } + ipcNameString.CloseBuffer(chars); + + // Concatenate the temp path and the formatted IPC name + if (strncat_s(formatBuffer, MAX_TRANSPORT_NAME_LENGTH, ipcName, chars) == STRUNCATE) { ERROR("TransportPipeName was larger than MAX_TRANSPORT_NAME_LENGTH"); return; } - int chars = snprintf(name, MAX_TRANSPORT_NAME_LENGTH, formatBuffer, prefix, id, disambiguationKey, suffix); - _ASSERTE(chars > 0 && (unsigned int)chars < MAX_TRANSPORT_NAME_LENGTH); + // Copy the final result to the output buffer + if (strcpy_s(name, MAX_TRANSPORT_NAME_LENGTH, formatBuffer) != 0) + { + ERROR("Failed to copy TransportPipeName to output buffer"); + return; + } } /*++