Compare commits

..

2 Commits

Author SHA1 Message Date
Alejandro Colomar
eae0b02796 Release 4.14.3
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2024-01-16 00:01:06 +01:00
Samanta Navarro
1c6a1206bd lib/sgetgrent.c: fix null pointer dereference
If reallocation fails in function list, then reset the size to 0 again.
Without the reset, the next call assumes that `members` points to
a memory location with reserved space.

Also use size_t instead of int for size to prevent signed integer
overflows. The length of group lines is not limited.

Fixes 45c0003e53 (4.14 release series)

Proof of Concept:

-  Prepare a group file (one long group line and a shorter one, both with a list of users)

	$ echo -n "root:x:0:" > /tmp/uwu
	$ yes , | tr -d '\n' | dd of=/tmp/uwu bs=10 count=3145728 seek=1 conv=notrunc iflag=fullblock
	$ echo -e "\nbin:x:1:," >> /tmp/uwu

-  Run grpck with tight memory constraints

	$ ulimit -d 102400
	$ grpck /tmp/uwu
	Segmentation fault (core dumped)

Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
Cherry-picked-from: a9e07c0feb ("lib/sgetgrent.c: fix null pointer dereference")
Link: <https://github.com/shadow-maint/shadow/pull/904>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2024-01-16 00:00:43 +01:00
2 changed files with 6 additions and 4 deletions

View File

@@ -4,7 +4,7 @@ m4_define([libsubid_abi_major], 4)
m4_define([libsubid_abi_minor], 0)
m4_define([libsubid_abi_micro], 0)
m4_define([libsubid_abi], [libsubid_abi_major.libsubid_abi_minor.libsubid_abi_micro])
AC_INIT([shadow], [4.14.2], [pkg-shadow-devel@lists.alioth.debian.org], [],
AC_INIT([shadow], [4.14.3], [pkg-shadow-devel@lists.alioth.debian.org], [],
[https://github.com/shadow-maint/shadow])
AM_INIT_AUTOMAKE([1.11 foreign dist-xz])
AC_CONFIG_MACRO_DIRS([m4])

View File

@@ -37,8 +37,8 @@
static char **list (char *s)
{
static char **members = NULL;
static int size = 0; /* max members + 1 */
int i;
static size_t size = 0; /* max members + 1 */
size_t i;
i = 0;
for (;;) {
@@ -47,8 +47,10 @@ static char **list (char *s)
if (i >= size) {
size = i + 100; /* at least: i + 1 */
members = REALLOCF(members, size, char *);
if (!members)
if (!members) {
size = 0;
return NULL;
}
}
if (!s || s[0] == '\0')
break;