Adrian Bunk
44 lines
1.4 KiB
Diff
44 lines
1.4 KiB
Diff
Origin: https://github.com/shadow-maint/shadow/commit/954e3d2e7113e9ac06632aee3c69b8d818cc8952
|
|
Reviewed-by: Sylvain Beucler <beuc@debian.org>
|
|
Last-Update: 2021-03-16
|
|
|
|
From 954e3d2e7113e9ac06632aee3c69b8d818cc8952 Mon Sep 17 00:00:00 2001
|
|
From: Tomas Mraz <tmraz@fedoraproject.org>
|
|
Date: Fri, 31 Mar 2017 16:25:06 +0200
|
|
Subject: [PATCH] Fix buffer overflow if NULL line is present in db.
|
|
|
|
If ptr->line == NULL for an entry, the first cycle will exit,
|
|
but the second one will happily write past entries buffer.
|
|
We actually do not want to exit the first cycle prematurely
|
|
on ptr->line == NULL.
|
|
Signed-off-by: Tomas Mraz <tmraz@fedoraproject.org>
|
|
---
|
|
lib/commonio.c | 8 ++++----
|
|
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
Index: shadow-4.4/lib/commonio.c
|
|
===================================================================
|
|
--- shadow-4.4.orig/lib/commonio.c
|
|
+++ shadow-4.4/lib/commonio.c
|
|
@@ -755,16 +755,16 @@ commonio_sort (struct commonio_db *db, i
|
|
for (ptr = db->head;
|
|
(NULL != ptr)
|
|
#if KEEP_NIS_AT_END
|
|
- && (NULL != ptr->line)
|
|
- && ( ('+' != ptr->line[0])
|
|
- && ('-' != ptr->line[0]))
|
|
+ && ((NULL == ptr->line)
|
|
+ || (('+' != ptr->line[0])
|
|
+ && ('-' != ptr->line[0])))
|
|
#endif
|
|
;
|
|
ptr = ptr->next) {
|
|
n++;
|
|
}
|
|
#if KEEP_NIS_AT_END
|
|
- if ((NULL != ptr) && (NULL != ptr->line)) {
|
|
+ if (NULL != ptr) {
|
|
nis = ptr;
|
|
}
|
|
#endif
|