Executive brief
entr is a utility that automatically reruns commands when monitored files change, commonly used by developers for build automation and testing. A heap buffer overflow in the run_utility() function allows a local attacker to trigger memory corruption, process crashes, and denial of service by providing command-line arguments or file paths that exceed the allocated buffer size. This could be exploited to disrupt development workflows or potentially escalate privileges on shared systems.
Technical details
The vulnerability is a heap-based buffer overflow (CWE-122) in the run_utility() function. The code allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it, but incorrectly tracks the remaining buffer space by using strlcpy()'s return value (total length of source) rather than actual bytes written. When the buffer fills exactly, the remaining size underflows as an unsigned size_t, causing subsequent writes to overflow the heap. The flaw is triggered locally via oversized command-line arguments or through the /_ substitution feature, which expands short tokens into longer runtime paths. An attacker can cause memory corruption, process abort, and denial of service. The issue was fixed in commit 2467fe0.
Affected products
- eradman entr through 5.8
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in commit 2467fe0