You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
64 lines
2.6 KiB
64 lines
2.6 KiB
7 years ago
|
commit ea7d8b95e2fcb81f68b04ed7787a3dbda023991a
|
||
|
|
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
|
||
|
|
Date: Thu Mar 27 19:48:15 2014 +0530
|
||
|
|
|
||
|
|
Avoid overlapping addresses to stpcpy calls in nscd (BZ #16760)
|
||
|
|
|
||
|
|
Calls to stpcpy from nscd netgroups code will have overlapping source
|
||
|
|
and destination when all three values in the returned triplet are
|
||
|
|
non-NULL and in the expected (host,user,domain) order. This is seen
|
||
|
|
in valgrind as:
|
||
|
|
|
||
|
|
==3181== Source and destination overlap in stpcpy(0x19973b48, 0x19973b48)
|
||
|
|
==3181== at 0x4C2F30A: stpcpy (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
|
||
|
|
==3181== by 0x12567A: addgetnetgrentX (string3.h:111)
|
||
|
|
==3181== by 0x12722D: addgetnetgrent (netgroupcache.c:665)
|
||
|
|
==3181== by 0x11114C: nscd_run_worker (connections.c:1338)
|
||
|
|
==3181== by 0x4E3C102: start_thread (pthread_create.c:309)
|
||
|
|
==3181== by 0x59B81AC: clone (clone.S:111)
|
||
|
|
==3181==
|
||
|
|
|
||
|
|
Fix this by using memmove instead of stpcpy.
|
||
|
|
|
||
|
|
diff --git glibc-2.17-c758a686/nscd/netgroupcache.c glibc-2.17-c758a686/nscd/netgroupcache.c
|
||
|
|
index 5d15aa4..820d823 100644
|
||
|
|
--- glibc-2.17-c758a686/nscd/netgroupcache.c
|
||
|
|
+++ glibc-2.17-c758a686/nscd/netgroupcache.c
|
||
|
|
@@ -216,6 +216,10 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
|
||
|
|
const char *nuser = data.val.triple.user;
|
||
|
|
const char *ndomain = data.val.triple.domain;
|
||
|
|
|
||
|
|
+ size_t hostlen = strlen (nhost ?: "") + 1;
|
||
|
|
+ size_t userlen = strlen (nuser ?: "") + 1;
|
||
|
|
+ size_t domainlen = strlen (ndomain ?: "") + 1;
|
||
|
|
+
|
||
|
|
if (nhost == NULL || nuser == NULL || ndomain == NULL
|
||
|
|
|| nhost > nuser || nuser > ndomain)
|
||
|
|
{
|
||
|
|
@@ -233,9 +237,6 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
|
||
|
|
: last + strlen (last) + 1 - buffer);
|
||
|
|
|
||
|
|
/* We have to make temporary copies. */
|
||
|
|
- size_t hostlen = strlen (nhost ?: "") + 1;
|
||
|
|
- size_t userlen = strlen (nuser ?: "") + 1;
|
||
|
|
- size_t domainlen = strlen (ndomain ?: "") + 1;
|
||
|
|
size_t needed = hostlen + userlen + domainlen;
|
||
|
|
|
||
|
|
if (buflen - req->key_len - bufused < needed)
|
||
|
|
@@ -269,9 +270,12 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
|
||
|
|
}
|
||
|
|
|
||
|
|
char *wp = buffer + buffilled;
|
||
|
|
- wp = stpcpy (wp, nhost) + 1;
|
||
|
|
- wp = stpcpy (wp, nuser) + 1;
|
||
|
|
- wp = stpcpy (wp, ndomain) + 1;
|
||
|
|
+ wp = memmove (wp, nhost ?: "", hostlen);
|
||
|
|
+ wp += hostlen;
|
||
|
|
+ wp = memmove (wp, nuser ?: "", userlen);
|
||
|
|
+ wp += userlen;
|
||
|
|
+ wp = memmove (wp, ndomain ?: "", domainlen);
|
||
|
|
+ wp += domainlen;
|
||
|
|
buffilled = wp - buffer;
|
||
|
|
++nentries;
|
||
|
|
}
|