You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
63 lines
2.6 KiB
63 lines
2.6 KiB
commit ea7d8b95e2fcb81f68b04ed7787a3dbda023991a |
|
Author: Siddhesh Poyarekar <siddhesh@redhat.com> |
|
Date: Thu Mar 27 19:48:15 2014 +0530 |
|
|
|
Avoid overlapping addresses to stpcpy calls in nscd (BZ #16760) |
|
|
|
Calls to stpcpy from nscd netgroups code will have overlapping source |
|
and destination when all three values in the returned triplet are |
|
non-NULL and in the expected (host,user,domain) order. This is seen |
|
in valgrind as: |
|
|
|
==3181== Source and destination overlap in stpcpy(0x19973b48, 0x19973b48) |
|
==3181== at 0x4C2F30A: stpcpy (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) |
|
==3181== by 0x12567A: addgetnetgrentX (string3.h:111) |
|
==3181== by 0x12722D: addgetnetgrent (netgroupcache.c:665) |
|
==3181== by 0x11114C: nscd_run_worker (connections.c:1338) |
|
==3181== by 0x4E3C102: start_thread (pthread_create.c:309) |
|
==3181== by 0x59B81AC: clone (clone.S:111) |
|
==3181== |
|
|
|
Fix this by using memmove instead of stpcpy. |
|
|
|
diff --git glibc-2.17-c758a686/nscd/netgroupcache.c glibc-2.17-c758a686/nscd/netgroupcache.c |
|
index 5d15aa4..820d823 100644 |
|
--- glibc-2.17-c758a686/nscd/netgroupcache.c |
|
+++ glibc-2.17-c758a686/nscd/netgroupcache.c |
|
@@ -216,6 +216,10 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, |
|
const char *nuser = data.val.triple.user; |
|
const char *ndomain = data.val.triple.domain; |
|
|
|
+ size_t hostlen = strlen (nhost ?: "") + 1; |
|
+ size_t userlen = strlen (nuser ?: "") + 1; |
|
+ size_t domainlen = strlen (ndomain ?: "") + 1; |
|
+ |
|
if (nhost == NULL || nuser == NULL || ndomain == NULL |
|
|| nhost > nuser || nuser > ndomain) |
|
{ |
|
@@ -233,9 +237,6 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, |
|
: last + strlen (last) + 1 - buffer); |
|
|
|
/* We have to make temporary copies. */ |
|
- size_t hostlen = strlen (nhost ?: "") + 1; |
|
- size_t userlen = strlen (nuser ?: "") + 1; |
|
- size_t domainlen = strlen (ndomain ?: "") + 1; |
|
size_t needed = hostlen + userlen + domainlen; |
|
|
|
if (buflen - req->key_len - bufused < needed) |
|
@@ -269,9 +270,12 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, |
|
} |
|
|
|
char *wp = buffer + buffilled; |
|
- wp = stpcpy (wp, nhost) + 1; |
|
- wp = stpcpy (wp, nuser) + 1; |
|
- wp = stpcpy (wp, ndomain) + 1; |
|
+ wp = memmove (wp, nhost ?: "", hostlen); |
|
+ wp += hostlen; |
|
+ wp = memmove (wp, nuser ?: "", userlen); |
|
+ wp += userlen; |
|
+ wp = memmove (wp, ndomain ?: "", domainlen); |
|
+ wp += domainlen; |
|
buffilled = wp - buffer; |
|
++nentries; |
|
}
|
|
|