d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

getusershell: don't write past end of line buffer reading local shells

Browse Source 
_local_initshells did not reset cp to the beginning of the line buffer
for every iteration that it called fgets(3), leading to writing past the
end of line with fairly long /etc/shells or excessively long line
lengths. Correct this by properly resetting cp.

PR:		192528
Submitted by:	Kyle Evans <kevans91@ksu.edu>
Reviewed by:	cem, jilles
Differential Revision:	https://reviews.freebsd.org/D10690
This commit is contained in:
Ed Maste 2017-05-15 17:57:09 +00:00
parent cf5cedd785
commit b47e69e69e
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/libc/gen/getusershell.c
View File

@ -115,8 +115,8 @@ _local_initshells(void *rv, void *cb_data, va_list ap)
if ((fp = fopen(_PATH_SHELLS, "re")) == NULL) if ((fp = fopen(_PATH_SHELLS, "re")) == NULL)
return NS_UNAVAIL; return NS_UNAVAIL;
while (fgets(line, MAXPATHLEN + 1, fp) != NULL) {
cp = line; cp = line;
while (fgets(cp, MAXPATHLEN + 1, fp) != NULL) {
while (*cp != '#' && *cp != '/' && *cp != '\0') while (*cp != '#' && *cp != '/' && *cp != '\0')
cp++; cp++;
if (*cp == '#' || *cp == '\0') if (*cp == '#' || *cp == '\0')
@ -124,7 +124,7 @@ _local_initshells(void *rv, void *cb_data, va_list ap)
sp = cp; sp = cp;
while (!isspace(*cp) && *cp != '#' && *cp != '\0') while (!isspace(*cp) && *cp != '#' && *cp != '\0')
cp++; cp++;
*cp++ = '\0'; *cp = '\0';
sl_add(sl, strdup(sp)); sl_add(sl, strdup(sp));
} }
(void)fclose(fp); (void)fclose(fp);