From patchwork Sat Aug 15 18:31:55 2015
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: Paul Pluzhnikov <ppluzhnikov@gmail.com>
X-Patchwork-Id: 8231
Received: (qmail 83987 invoked by alias); 15 Aug 2015 18:31:59 -0000
Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Id: <libc-alpha.sourceware.org>
List-Unsubscribe: <mailto:libc-alpha-unsubscribe-##L=##H@sourceware.org>
List-Subscribe: <mailto:libc-alpha-subscribe@sourceware.org>
List-Archive: <http://sourceware.org/ml/libc-alpha/>
List-Post: <mailto:libc-alpha@sourceware.org>
List-Help: <mailto:libc-alpha-help@sourceware.org>,
	<http://sourceware.org/ml/#faqs>
Sender: libc-alpha-owner@sourceware.org
Delivered-To: mailing list libc-alpha@sourceware.org
Received: (qmail 83971 invoked by uid 89); 15 Aug 2015 18:31:58 -0000
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-1.5 required=5.0 tests=AWL, BAYES_00,
	FREEMAIL_FROM, RCVD_IN_DNSWL_LOW,
	SPF_PASS autolearn=ham version=3.3.2
X-HELO: mail-ig0-f178.google.com
MIME-Version: 1.0
X-Received: by 10.50.117.98 with SMTP id kd2mr9434239igb.78.1439663515527;
	Sat, 15 Aug 2015 11:31:55 -0700 (PDT)
Date: Sat, 15 Aug 2015 11:31:55 -0700
Message-ID: 
 <CAPC3xaqdOk4EWQJEiBLidfVxSx1iH5F9k_DTZDamkjQR1xZ3Gw@mail.gmail.com>
Subject: [patch] Fix BZ #18660 -- overflow in getusershell
From: Paul Pluzhnikov <ppluzhnikov@gmail.com>
To: GLIBC Devel <libc-alpha@sourceware.org>
Cc: Tobias Stoeckmann <tobias@stoeckmann.org>

Greetings,

Attached patch fixes BZ #18660 -- overflow in getusershell.

Note: the file does not follow GNU coding convention, should I make a
whitespace-only pass over it?
Note: Tobias proposed a different patch:
https://sourceware.org/bugzilla/attachment.cgi?id=8502, but I like my
patch better.

P.S. AFAICT, this is nearly impossible to test :-(

Thanks,

2015-08-15  Paul Pluzhnikov  <ppluzhnikov@google.com>
            Tobias Stoeckmann <tobias@stoeckmann.org>

        [BZ #18660]
        * misc/getusershell.c (initshells): Fix possible overflow.

diff --git a/misc/getusershell.c b/misc/getusershell.c
index fc2c43b..44143dc 100644
--- a/misc/getusershell.c
+++ b/misc/getusershell.c
@@ -119,7 +119,7 @@ initshells (void)
 	flen = statb.st_size + 3;
 	if ((strings = malloc(flen)) == NULL)
 		goto init_okshells;
-	shells = malloc(statb.st_size / 3 * sizeof (char *));
+	shells = malloc(((statb.st_size / 3) + 2) * sizeof (char *));
 	if (shells == NULL) {
 		free(strings);
 		strings = NULL;
@@ -130,7 +130,8 @@ initshells (void)
 	while (fgets_unlocked(cp, flen - (cp - strings), fp) != NULL) {
 		while (*cp != '#' && *cp != '/' && *cp != '\0')
 			cp++;
-		if (*cp == '#' || *cp == '\0' || cp[1] == '\0')
+		/* Reject non-absolute paths, or anything too short.  */
+		if (cp[0] != '/' || cp[1] == '\0' || isspace(cp[1]))
 			continue;
 		*sp++ = cp;
 		while (!isspace(*cp) && *cp != '#' && *cp != '\0')