660d4fe299
The length of the name returned from the $LOGNAME and $USER can be very long and it was being concatenated to a fixed length buffer with no bounds checking. Fix this problem by limiting the length of the name copied. Additionally, this name is actually used to create a format string to be used in adding log file entries so embedded % characters in the name could confuse *printf(), and embedded whitespace could confuse a log file parser. Handle the former by escaping each % with an additional %, and handle the latter by simply stripping it out. Clean up the code by moving the variable declarations to the top of the function, formatting them to conform with style, and moving intialization elsewhere. Reduce code indentation by returning early in a couple of places. Reported by: Coverity CID: 1006692 Reviewed by: markj (previous version) MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D6490 |
||
|---|---|---|
| .. | ||
| tests | ||
| bitmap.c | ||
| bitmap.h | ||
| cpdir.c | ||
| grupd.c | ||
| Makefile | ||
| Makefile.depend | ||
| psdate.c | ||
| psdate.h | ||
| pw_conf.c | ||
| pw_group.c | ||
| pw_log.c | ||
| pw_nis.c | ||
| pw_user.c | ||
| pw_utils.c | ||
| pw_vpw.c | ||
| pw.8 | ||
| pw.c | ||
| pw.conf.5 | ||
| pw.h | ||
| pwupd.c | ||
| pwupd.h | ||
| README | ||
| rm_r.c | ||
| strtounum.c | ||
pw is a command-line driven passwd/group editor utility that provides an easy and safe means of modifying of any/all fields in the system password files, and has an add, modify and delete mode for user and group records. Command line options have been fashioned to be similar to those used by the Sun/shadow commands: useradd, usermod, userdel, groupadd, groupmod, groupdel, but combines all operations within the single command `pw'. User add mode also provides a means of easily setting system useradd defaults (see pw.conf.5), so that adding a user is as easy as issuing the command "pw useradd <loginid>". Creation of a unique primary group for each user and automatic membership in secondary groups is fully supported. This program may be FreeBSD specific, but should be trivial to port to other bsd4.4 variants. Author and maintainer: David L. Nugent, <davidn@blaze.net.au> $FreeBSD$