AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-09 23:00:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

nss_db: Propagate ERANGE error if parse_line fails [BZ #19837]

Browse Source 
Reproducer (needs to run as root):

perl -e \
  'print "large❌999:" . join(",", map {"user$_"} (1 .. 135))."\n"' \
  >> /etc/group
cd /var/db
make
getent -s db group

After the fix, the last command should list the "large" group.

The magic number 135 has been chosen so that the line is shorter than
1024 bytes, but the pointers required to encode the member array will
cross the threshold, triggering the bug.
This commit is contained in:
Florian Weimer 2016-03-29 11:27:32 +02:00
parent 0791f91dff
commit a6033052d0
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2016-03-29 Florian Weimer <fweimer@redhat.com>
[BZ #19837]
* nss/nss_db/db-XXX.c (_nss_db_getENTNAME_r): Propagate ERANGE
error if parse_line fails.
2016-03-28 H.J. Lu <hongjiu.lu@intel.com>
* sysdeps/x86/cpu-features.h (bit_cpu_ERMS): New.

4
nss/nss_db/db-XXX.c
View File

@ -288,8 +288,8 @@ CONCAT(_nss_db_get,ENTNAME_r) (struct STRUCTURE *result, char *buffer,
}
if (err < 0)
{
H_ERRNO_SET (HOST_NOT_FOUND);
status = NSS_STATUS_NOTFOUND;
H_ERRNO_SET (NETDB_INTERNAL);
status = NSS_STATUS_TRYAGAIN;
break;
}