FreeBSD Bugzilla – Attachment 217545 Details for
Bug 248932
integer underflow in grp_unmarshal_func triggered by nscd
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Fix integer underflow in getgrent.c
getgrent_underflow.diff (text/plain), 749 bytes, created by
Alan Somers
on 2020-08-26 17:01:50 UTC
(
hide
)
Description:
Fix integer underflow in getgrent.c
Filename:
MIME Type:
Creator:
Alan Somers
Created:
2020-08-26 17:01:50 UTC
Size:
749 bytes
patch
obsolete
>Index: lib/libc/gen/getgrent.c >=================================================================== >--- lib/libc/gen/getgrent.c (revision 364821) >+++ lib/libc/gen/getgrent.c (working copy) >@@ -332,10 +332,18 @@ > orig_buf_size = va_arg(ap, size_t); > ret_errno = va_arg(ap, int *); > >- if (orig_buf_size < >- buffer_size - sizeof(struct group) - sizeof(char *)) { >+ if (orig_buf_size + sizeof(struct group) + sizeof(char *) < >+ buffer_size) >+ { > *ret_errno = ERANGE; > return (NS_RETURN); >+ } else if (buffer_size < sizeof(struct group) + sizeof(char *)) { >+ /* >+ * nscd(8) sometimes returns buffer_size=1 for nonexistent >+ * groups. >+ */ >+ *ret_errno = 0; >+ return (NS_UNAVAIL); > } > > memcpy(grp, buffer, sizeof(struct group));
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=217545">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 248932
: 217545