From owner-freebsd-bugs@FreeBSD.ORG Fri Nov 30 23:25:38 2012 Return-Path: Delivered-To: freebsd-bugs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id F3CB3AC2 for ; Fri, 30 Nov 2012 23:25:37 +0000 (UTC) (envelope-from lists@eitanadler.com) Received: from mail-lb0-f182.google.com (mail-lb0-f182.google.com [209.85.217.182]) by mx1.freebsd.org (Postfix) with ESMTP id 604EE8FC13 for ; Fri, 30 Nov 2012 23:25:37 +0000 (UTC) Received: by mail-lb0-f182.google.com with SMTP id go10so1124480lbb.13 for ; Fri, 30 Nov 2012 15:25:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=eitanadler.com; s=0xdeadbeef; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=ppVvNcntNOOovdhm79KXK6GU63sd7iTbp7+GqgDBIx4=; b=sD8GOTceJrlVy9D3Tk/3aa7xSyJ8hTRPEjFjTFc4KIQTaRU1Sb/48WlNd39qXzaVeE Fzm9eir2M7wk1fZDnQERY34p6t9emN/Zzg3Oj+rJRuXgriNhp4O/zg+CPDvFk2dTR/GV aVhDELYSlTOCBfNI8N4XaQyb/wgxE1+6olrzQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:x-gm-message-state; bh=ppVvNcntNOOovdhm79KXK6GU63sd7iTbp7+GqgDBIx4=; b=NC2TY7jk8CLQmpsHdw6KxzImtrzXNNou0cr4KkERZWeNjjDvGbAckh5udRM2rKWkFo UuAtkZ6E2bYcbTRCBzWNn9wSG6gjcNxnVoJ80xBkL7ThNLxFizMskLw06XSaobXmBIsi zmO6fIBLJHljKoGS0Et5jvNXtFRfa7UQK0j+wkJ0acwGRJ0/0bhwPkvS2+TF2pTsZyqB 7M34hBzeKCrvUX6+h09j4w/bxV3+hHKqauhmSYDKMMJ2ZRjqjqra86kRgeYW/AFBWiDs UQ8viFIyanjeF2PHPuwHVRhqaBJtH5Kx/Chj2c8jS3PWQu4iWbt5D4pBggQabM1Kmzqa Y8qA== Received: by 10.152.108.48 with SMTP id hh16mr2790828lab.25.1354317936171; Fri, 30 Nov 2012 15:25:36 -0800 (PST) MIME-Version: 1.0 Received: by 10.112.154.168 with HTTP; Fri, 30 Nov 2012 15:25:05 -0800 (PST) In-Reply-To: <201211281841.qASIfkx4033378@red.freebsd.org> References: <201211281841.qASIfkx4033378@red.freebsd.org> From: Eitan Adler Date: Fri, 30 Nov 2012 18:25:05 -0500 Message-ID: Subject: Re: bin/173977: pw(8) does not do range-checking on UIDs/GUIs from user's input, passwd DB becomes inconsistent To: Nikos Vassiliadis Content-Type: text/plain; charset=UTF-8 X-Gm-Message-State: ALoCoQmgT8KSYMEDesreErGpVpvOz0+iymfKRZ9YgjkFBmbywRg33HK5Wo1n4hClIqvlyhuKicwl Cc: freebsd-bugs@freebsd.org, bug-followup@freebsd.org X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Nov 2012 23:25:38 -0000 On 28 November 2012 13:41, Nikos Vassiliadis wrote: > Index: usr.sbin/pw/pw_group.c > =================================================================== > --- usr.sbin/pw/pw_group.c (revision 243652) > +++ usr.sbin/pw/pw_group.c (working copy) > @@ -350,6 +350,8 @@ > */ > if (a_gid != NULL) { > gid = (gid_t) atol(a_gid->val); atoi overflow is considered undefined behavior so the error can not be meaningfully be checked. In particular the compiler may assume the error will never occur and elide the check. Ideally this call is replaced with one of the stro* functions. > + if (errno == ERANGE || errno == EINVAL) > + errx(EX_DATAERR, "gid %s is invalid", a_gid->val); -- Eitan Adler