Author: asomers Date: Thu Nov 26 23:34:02 2020 New Revision: 368085 URL: https://svnweb.freebsd.org/changeset/base/368085
Log: MFC r365910: fix integer underflow in getgrnam_r and getpwnam_r Sometimes nscd(8) will return a 1-byte buffer for a nonexistent entry. This triggered an integer underflow in grp_unmarshal_func, causing getgrnam_r to return ERANGE instead of 0. Fix the user's buffer size check, and add a correct check for a too-small nscd buffer. PR: 248932 Event: September 2020 Bugathon Reviewed by: markj Sponsored by: Axcient Differential Revision: https://reviews.freebsd.org/D26204 Modified: stable/12/lib/libc/gen/getgrent.c stable/12/lib/libc/gen/getpwent.c Directory Properties: stable/12/ (props changed) Modified: stable/12/lib/libc/gen/getgrent.c ============================================================================== --- stable/12/lib/libc/gen/getgrent.c Thu Nov 26 22:49:05 2020 (r368084) +++ stable/12/lib/libc/gen/getgrent.c Thu Nov 26 23:34:02 2020 (r368085) @@ -334,14 +334,27 @@ grp_unmarshal_func(char *buffer, size_t buffer_size, v orig_buf_size = va_arg(ap, size_t); ret_errno = va_arg(ap, int *); - if (orig_buf_size < - buffer_size - sizeof(struct group) - sizeof(char *)) { + if (orig_buf_size + sizeof(struct group) + sizeof(char *) < buffer_size) + { *ret_errno = ERANGE; return (NS_RETURN); + } else if (buffer_size < sizeof(struct group) + sizeof(char *)) { + /* + * nscd(8) sometimes returns buffer_size=1 for nonexistent + * entries. + */ + *ret_errno = 0; + return (NS_NOTFOUND); } memcpy(grp, buffer, sizeof(struct group)); memcpy(&p, buffer + sizeof(struct group), sizeof(char *)); + + if (orig_buf_size + sizeof(struct group) + sizeof(char *) + + _ALIGN(p) - (size_t)p < buffer_size) { + *ret_errno = ERANGE; + return (NS_RETURN); + } orig_buf = (char *)_ALIGN(orig_buf); memcpy(orig_buf, buffer + sizeof(struct group) + sizeof(char *) + Modified: stable/12/lib/libc/gen/getpwent.c ============================================================================== --- stable/12/lib/libc/gen/getpwent.c Thu Nov 26 22:49:05 2020 (r368084) +++ stable/12/lib/libc/gen/getpwent.c Thu Nov 26 23:34:02 2020 (r368085) @@ -389,10 +389,17 @@ pwd_unmarshal_func(char *buffer, size_t buffer_size, v orig_buf_size = va_arg(ap, size_t); ret_errno = va_arg(ap, int *); - if (orig_buf_size < - buffer_size - sizeof(struct passwd) - sizeof(char *)) { + if (orig_buf_size + sizeof(struct passwd) + sizeof(char *) < + buffer_size) { *ret_errno = ERANGE; return (NS_RETURN); + } else if (buffer_size < sizeof(struct passwd) + sizeof(char *)) { + /* + * nscd(8) sometimes returns buffer_size=1 for nonexistent + * entries. + */ + *ret_errno = 0; + return (NS_NOTFOUND); } memcpy(pwd, buffer, sizeof(struct passwd)); _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
