From owner-freebsd-security  Mon Jun  7  8:14:54 1999
Delivered-To: freebsd-security@freebsd.org
Received: from flood.ping.uio.no (flood.ping.uio.no [129.240.78.31])
	by hub.freebsd.org (Postfix) with ESMTP id 6A0D61522D
	for <freebsd-security@FreeBSD.ORG>; Mon,  7 Jun 1999 08:14:51 -0700 (PDT)
	(envelope-from des@flood.ping.uio.no)
Received: (from des@localhost)
	by flood.ping.uio.no (8.9.3/8.9.1) id RAA33892;
	Mon, 7 Jun 1999 17:14:45 +0200 (CEST)
	(envelope-from des)
To: Mike Nowlin <mike@argos.org>
Cc: John Baldwin <jobaldwi@vt.edu>, Wes Peters <wes@softweyr.com>,
	freebsd-security@FreeBSD.ORG
Subject: Re: NIS strangeness
References: <Pine.LNX.4.05.9906062349490.4215-100000@jason.argos.org>
From: Dag-Erling Smorgrav <des@flood.ping.uio.no>
Date: 07 Jun 1999 17:14:45 +0200
In-Reply-To: Mike Nowlin's message of "Sun, 6 Jun 1999 23:56:07 -0400 (EDT)"
Message-ID: <xzpvhd0kpp6.fsf@flood.ping.uio.no>
Lines: 15
X-Mailer: Gnus v5.5/Emacs 19.34
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Mike Nowlin <mike@argos.org> writes:
> [test program snipped]
> If root runs this program, it SEGV's and blows up.  But if anybody else
> runs it, it comes back with 

The test program you posted doesn't do *any* error-checking... which
means that if getpwnam() fails, your program will happily try to
dereference a null pointer, hence the SIGSEGV.

As to *why* getpwnam() fails, I have no clue. It works fine for me,
both as a regular user and as root.

DES
-- 
Dag-Erling Smorgrav - des@flood.ping.uio.no


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message