aboutsummaryrefslogtreecommitdiff
path: root/nss
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2019-01-31 18:49:58 +0100
committerFlorian Weimer <fweimer@redhat.com>2019-01-31 18:49:58 +0100
commit2bac7daa58da1a313bd452369b0508b31e146637 (patch)
treecb26cc3d34519adb5110c443400ff47b3c3cc00b /nss
parentde44ab67aa4eec369deea828733567c35a0611c0 (diff)
downloadglibc-2bac7daa58da1a313bd452369b0508b31e146637.tar
glibc-2bac7daa58da1a313bd452369b0508b31e146637.tar.gz
glibc-2bac7daa58da1a313bd452369b0508b31e146637.tar.bz2
glibc-2bac7daa58da1a313bd452369b0508b31e146637.zip
nss_files: Fix /etc/aliases null pointer dereference [BZ #24059]
If /etc/aliases ends with a continuation line (a line that starts with whitespace) which does not have a trailing newline character, the file parser would crash due to a null pointer dereference. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Diffstat (limited to 'nss')
-rw-r--r--nss/Makefile2
-rw-r--r--nss/nss_files/files-alias.c10
-rw-r--r--nss/tst-nss-files-alias-truncated.c66
3 files changed, 78 insertions, 0 deletions
diff --git a/nss/Makefile b/nss/Makefile
index 0fa28f0c5e..e66e01d45a 100644
--- a/nss/Makefile
+++ b/nss/Makefile
@@ -68,6 +68,7 @@ tests += tst-nss-files-hosts-erange
tests += tst-nss-files-hosts-multi
tests += tst-nss-files-hosts-getent
tests += tst-nss-files-alias-leak
+tests += tst-nss-files-alias-truncated
endif
# If we have a thread library then we can test cancellation against
@@ -176,3 +177,4 @@ $(objpfx)tst-nss-files-hosts-multi: $(libdl)
$(objpfx)tst-nss-files-hosts-getent: $(libdl)
$(objpfx)tst-nss-files-alias-leak: $(libdl)
$(objpfx)tst-nss-files-alias-leak.out: $(objpfx)/libnss_files.so
+$(objpfx)tst-nss-files-alias-truncated: $(objpfx)/libnss_files.so
diff --git a/nss/nss_files/files-alias.c b/nss/nss_files/files-alias.c
index 540eb9c678..34d7aa84cc 100644
--- a/nss/nss_files/files-alias.c
+++ b/nss/nss_files/files-alias.c
@@ -333,6 +333,16 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
can be ignored. */
first_unused[room_left - 1] = '\xff';
line = fgets_unlocked (first_unused, room_left, stream);
+ if (line == NULL)
+ {
+ /* Continuation line without any data and
+ without a newline at the end. Treat it as an
+ empty line and retry, reaching EOF once
+ more. */
+ line = first_unused;
+ *line = '\0';
+ continue;
+ }
if (first_unused[room_left - 1] != '\xff')
goto no_more_room;
cp = strpbrk (line, "#\n");
diff --git a/nss/tst-nss-files-alias-truncated.c b/nss/tst-nss-files-alias-truncated.c
new file mode 100644
index 0000000000..2d6aba3c0e
--- /dev/null
+++ b/nss/tst-nss-files-alias-truncated.c
@@ -0,0 +1,66 @@
+/* Check handling of missing end-of-line at end of /etc/aliases (bug 24059).
+ Copyright (C) 2019 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+#include <aliases.h>
+#include <nss.h>
+#include <stddef.h>
+#include <support/check.h>
+#include <support/namespace.h>
+#include <support/test-driver.h>
+#include <support/xunistd.h>
+
+static void
+in_chroot (void *closure)
+{
+ struct support_chroot *chroot_env = closure;
+ xchroot (chroot_env->path_chroot);
+
+ struct aliasent *e = getaliasbyname ("user1");
+ TEST_VERIFY_EXIT (e != NULL);
+ TEST_COMPARE_STRING (e->alias_name, "user1");
+ TEST_COMPARE (e->alias_members_len, 1);
+ TEST_VERIFY_EXIT (e->alias_members != NULL);
+ TEST_COMPARE_STRING (e->alias_members[0], "alias1");
+ TEST_VERIFY (e->alias_local);
+}
+
+static int
+do_test (void)
+{
+ /* nss_files has already been loaded via DT_NEEDED, outside the
+ chroot. */
+ __nss_configure_lookup ("aliases", "files");
+
+ support_become_root ();
+ if (!support_can_chroot ())
+ return EXIT_UNSUPPORTED;
+
+ struct support_chroot *chroot_env = support_chroot_create
+ ((struct support_chroot_configuration)
+ {
+ .aliases = "user1: alias1,\n"
+ " " /* Continuation line, but no \n. */
+ });
+
+ support_isolate_in_subprocess (in_chroot, chroot_env);
+
+ support_chroot_free (chroot_env);
+ return 0;
+}
+
+#include <support/test-driver.c>