From 804e448edca8515383b7afc24f6c0b6c0273ff22 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 14 Feb 2026 20:21:44 +0000 Subject: [PATCH 1/2] Initial plan From 4a33b66b3aa221d89b2d8b5995aa0d5a3e886838 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 14 Feb 2026 20:23:28 +0000 Subject: [PATCH 2/2] Remove redundant access() check to fix TOCTOU vulnerability Co-authored-by: Durbatuluk1701 <52861844+Durbatuluk1701@users.noreply.github.com> --- stubs/FFI/sys_ffi.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/stubs/FFI/sys_ffi.c b/stubs/FFI/sys_ffi.c index dacbbaf..fd122a4 100755 --- a/stubs/FFI/sys_ffi.c +++ b/stubs/FFI/sys_ffi.c @@ -266,16 +266,6 @@ void ffiexec_process_io(const char *commandIn, const long clen, char *a, const l return; } - // Verify the executable exists and is accessible - if (access(process_path, X_OK) != 0) - { - DEBUG_PRINTF("ffiexec_process_io: Process not found or not executable: %s (%s)\n", - process_path, strerror(errno)); - free(process_path); - a[RESPONSE_CODE_START] = PATH_ERROR; - return; - } - // ---------- Create pipes ---------- int stdin_pipe[2]; // Parent writes to [1], child reads from [0] int stdout_pipe[2]; // Child writes to [1], parent reads from [0]