[Dhanu-dynamic]

KillGhostLink() in libpromises/files_links.c and LinkCopy() in
cf-agent/verify_files_utils.c reconstruct the absolute target of a relative
symbolic link by appending the readlink() result onto the link's directory
name in a CF_BUFSIZE stack buffer:

// files_links.c, linkpath is char[CF_BUFSIZE]
strcat(linkpath, linkbuf);

// verify_files_utils.c, vbuff is char[CF_BUFSIZE]
strncat(vbuff, linkbuf, CF_BUFSIZE - 1);

The strcat() is unbounded, and the strncat() third argument is the maximum
number of bytes to take from the source, not the space left in vbuff, so it
does not bound the destination either. readlink() returns up to CF_BUFSIZE-1
bytes, so a symlink whose relative target is near CF_BUFSIZE, placed by an
unprivileged user in any directory a root files promise walks (depth_search,
perms, or a link-type copy), overflows the agent's stack. KillGhostLink()
runs on every symlink met during a recursive descent, before the dead-link
stat(), so reaching it only takes one such link under a recursive promise.

Bound both appends with strlcat(..., sizeof(buf)), the same way ExpandLinks()
in files_links.c already bounds this exact operation, and have KillGhostLink()
bail out with an "Internal limit reached" message when the target does not
fit. Valid links are unchanged.

Verified with AddressSanitizer via a regression test in
tests/unit/files_links_test.c: a relative symlink with a CF_BUFSIZE-sized
target aborts KillGhostLink() with a stack overflow before the change and
returns cleanly after it.

[cf-bottom]

Thanks for submitting a pull request! Maybe @craigcomstock can review this?