d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

getgrent.c: adjust _nextypgroup() slightly so that it continues processing

Browse Source 
the group map after encountering a badly formatted entry.

getpwent.c: same as above for _nextyppass(), and also turn a couple of
sprintf()s into snprintf()s to avoid potential buffer overruns. (The
other day I nearly went mad because of a username in my NIS database
that's actually 9 characters long instead of 8. Stuffing a 9-character
username into an 8-character buffer can do some strange things.)

(This reminds me: I hope somebody's planning to fix the buffer overrun
security hole in syslog(3) before 2.1 ships.)
This commit is contained in:
Bill Paul 1995-09-05 19:52:59 +00:00
parent c734076e9c
commit 400b841301
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/libc/gen/getgrent.c
View File

@ -409,7 +409,10 @@ _nextypgroup(struct group *gr)
strcpy(resultbuf, result);
free(result);
if(result = strchr(resultbuf, '\n')) *result = '\0';
return(_gr_breakout_yp(gr, resultbuf));
if (_gr_breakout_yp(gr, resultbuf))
return(1);
else
goto tryagain;
}
}

9
lib/libc/gen/getpwent.c
View File

@ -670,7 +670,7 @@ _getyppass(struct passwd *pw, const char *name, const char *map)
if(resultlen >= sizeof resultbuf) return 0;
strcpy(resultbuf, result);
sprintf (user, "%.*s", (strchr(result, ':') - result), result);
snprintf (user, sizeof(user), "%.*s", (strchr(result, ':') - result), result);
_pw_passwd.pw_fields = -1; /* Impossible value */
if (_scancaches((char *)&user)) {
free(result);
@ -736,7 +736,7 @@ _nextyppass(struct passwd *pw)
}
strcpy(resultbuf, result);
sprintf(user, "%.*s", (strchr(result, ':') - result), result);
snprintf(user, sizeof(user), "%.*s", (strchr(result, ':') - result), result);
_pw_passwd.pw_fields = -1; /* Impossible value */
if (_scancaches((char *)&user)) {
free(result);
@ -747,7 +747,10 @@ _nextyppass(struct passwd *pw)
if (_pw_passwd.pw_fields == -1)
goto tryagain;
if(result = strchr(resultbuf, '\n')) *result = '\0';
return(_pw_breakout_yp(pw, resultbuf, gotmaster));
if (_pw_breakout_yp(pw, resultbuf, gotmaster))
return(1);
else
goto tryagain;
}
}