VesperOS/shadow
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lib/sgetgrent.c: sgetgrent(): Fix use-after-free bug

Browse Source 
We were reusing a leftover from parsing a previous line if
(i == NFIELDS-1).  A few lines below this check, we use read the element
in [3] (that is, [NFIELDS-1]), without having written it in this call.

Be stricter, and require that all NFIELDS fields are found.

Fixes: 45c6603cc8 (2007-10-07, "[svn-upgrade] Integrating new upstream version, shadow (19990709)")
Closes: <https://github.com/shadow-maint/shadow/issues/1144>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
This commit is contained in:
Alejandro Colomar
2024-12-07 00:07:27 +01:00
committed by Serge Hallyn
parent b75ea29821
commit 8424d7c494
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/sgetgrent.c
+1 -1
View File
@@ -89,7 +89,7 @@ struct group *sgetgrent (const char *buf)
for (cp = grpbuf, i = 0; (i < NFIELDS) && (NULL != cp); i++)
grpfields[i] = strsep(&cp, ":");
if (i < (NFIELDS - 1) || *grpfields[2] == '\0' || cp != NULL) {
if (i < NFIELDS || *grpfields[2] == '\0' || cp != NULL) {
return NULL;
}
grent.gr_name = grpfields[0];