aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlan Somers <asomers@FreeBSD.org>2020-09-19 19:08:27 +0000
committerAlan Somers <asomers@FreeBSD.org>2020-09-19 19:08:27 +0000
commit9ad1d357e0db6175124257156f035a043c2ced8c (patch)
treee8b4216a8d4e345587acd3d44732d15e9be313be
parentc6989859ae9388eeb46a24fe88f9b8d07101c710 (diff)
downloadsrc-9ad1d357e0db6175124257156f035a043c2ced8c.tar.gz
src-9ad1d357e0db6175124257156f035a043c2ced8c.zip
fix integer underflow in getgrnam_r and getpwnam_r
Sometimes nscd(8) will return a 1-byte buffer for a nonexistent entry. This triggered an integer underflow in grp_unmarshal_func, causing getgrnam_r to return ERANGE instead of 0. Fix the user's buffer size check, and add a correct check for a too-small nscd buffer. PR: 248932 Event: September 2020 Bugathon Reviewed by: markj MFC after: 2 weeks Sponsored by: Axcient Differential Revision: https://reviews.freebsd.org/D26204
Notes
Notes: svn path=/head/; revision=365910
-rw-r--r--lib/libc/gen/getgrent.c17
-rw-r--r--lib/libc/gen/getpwent.c11
2 files changed, 24 insertions, 4 deletions
diff --git a/lib/libc/gen/getgrent.c b/lib/libc/gen/getgrent.c
index 650ba1de9a68..b3699cae3c45 100644
--- a/lib/libc/gen/getgrent.c
+++ b/lib/libc/gen/getgrent.c
@@ -334,15 +334,28 @@ grp_unmarshal_func(char *buffer, size_t buffer_size, void *retval, va_list ap,
orig_buf_size = va_arg(ap, size_t);
ret_errno = va_arg(ap, int *);
- if (orig_buf_size <
- buffer_size - sizeof(struct group) - sizeof(char *)) {
+ if (orig_buf_size + sizeof(struct group) + sizeof(char *) < buffer_size)
+ {
*ret_errno = ERANGE;
return (NS_RETURN);
+ } else if (buffer_size < sizeof(struct group) + sizeof(char *)) {
+ /*
+ * nscd(8) sometimes returns buffer_size=1 for nonexistent
+ * entries.
+ */
+ *ret_errno = 0;
+ return (NS_NOTFOUND);
}
memcpy(grp, buffer, sizeof(struct group));
memcpy(&p, buffer + sizeof(struct group), sizeof(char *));
+ if (orig_buf_size + sizeof(struct group) + sizeof(char *) +
+ _ALIGN(p) - (size_t)p < buffer_size) {
+ *ret_errno = ERANGE;
+ return (NS_RETURN);
+ }
+
orig_buf = (char *)_ALIGN(orig_buf);
memcpy(orig_buf, buffer + sizeof(struct group) + sizeof(char *) +
_ALIGN(p) - (size_t)p,
diff --git a/lib/libc/gen/getpwent.c b/lib/libc/gen/getpwent.c
index 1f2ccf33150a..09f84f9576ee 100644
--- a/lib/libc/gen/getpwent.c
+++ b/lib/libc/gen/getpwent.c
@@ -389,10 +389,17 @@ pwd_unmarshal_func(char *buffer, size_t buffer_size, void *retval, va_list ap,
orig_buf_size = va_arg(ap, size_t);
ret_errno = va_arg(ap, int *);
- if (orig_buf_size <
- buffer_size - sizeof(struct passwd) - sizeof(char *)) {
+ if (orig_buf_size + sizeof(struct passwd) + sizeof(char *) <
+ buffer_size) {
*ret_errno = ERANGE;
return (NS_RETURN);
+ } else if (buffer_size < sizeof(struct passwd) + sizeof(char *)) {
+ /*
+ * nscd(8) sometimes returns buffer_size=1 for nonexistent
+ * entries.
+ */
+ *ret_errno = 0;
+ return (NS_NOTFOUND);
}
memcpy(pwd, buffer, sizeof(struct passwd));