VesperOS/shadow
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lib/sgetgrent.c: fix null pointer dereference

Browse Source 
If reallocation fails in function list, then reset the size to 0 again.
Without the reset, the next call assumes that `members` points to
a memory location with reserved space.

Also use size_t instead of int for size to prevent signed integer
overflows. The length of group lines is not limited.

Fixes 45c0003e53 (4.14 release series)

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
This commit is contained in:
Samanta Navarro
2024-01-15 13:06:35 -06:00
committed by Serge Hallyn
parent 4c0c7c52f1
commit a9e07c0feb
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/sgetgrent.c
+5 -3
View File
@@ -37,8 +37,8 @@
static char **list (char *s) static char **list (char *s)
{ {
static char **members = NULL; static char **members = NULL;
static int size = 0; /* max members + 1 */ static size_t size = 0; /* max members + 1 */
int i; size_t i;
i = 0; i = 0;
for (;;) { for (;;) {
@@ -47,8 +47,10 @@ static char **list (char *s)
if (i >= size) { if (i >= size) {
size = i + 100; /* at least: i + 1 */ size = i + 100; /* at least: i + 1 */
members = REALLOCF(members, size, char *); members = REALLOCF(members, size, char *);
if (!members) if (!members) {
size = 0;
return NULL; return NULL;
}
} }
if (!s || s[0] == '\0') if (!s || s[0] == '\0')
break; break;