Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 26 Nov 2020 23:34:02 +0000 (UTC)
From:      Alan Somers <asomers@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org
Subject:   svn commit: r368085 - stable/12/lib/libc/gen
Message-ID:  <202011262334.0AQNY2Mt044289@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: asomers
Date: Thu Nov 26 23:34:02 2020
New Revision: 368085
URL: https://svnweb.freebsd.org/changeset/base/368085

Log:
  MFC r365910:
  
  fix integer underflow in getgrnam_r and getpwnam_r
  
  Sometimes nscd(8) will return a 1-byte buffer for a nonexistent entry. This
  triggered an integer underflow in grp_unmarshal_func, causing getgrnam_r to
  return ERANGE instead of 0.
  
  Fix the user's buffer size check, and add a correct check for a too-small
  nscd buffer.
  
  PR:		248932
  Event:		September 2020 Bugathon
  Reviewed by:	markj
  Sponsored by:	Axcient
  Differential Revision: https://reviews.freebsd.org/D26204

Modified:
  stable/12/lib/libc/gen/getgrent.c
  stable/12/lib/libc/gen/getpwent.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/lib/libc/gen/getgrent.c
==============================================================================
--- stable/12/lib/libc/gen/getgrent.c	Thu Nov 26 22:49:05 2020	(r368084)
+++ stable/12/lib/libc/gen/getgrent.c	Thu Nov 26 23:34:02 2020	(r368085)
@@ -334,14 +334,27 @@ grp_unmarshal_func(char *buffer, size_t buffer_size, v
 	orig_buf_size = va_arg(ap, size_t);
 	ret_errno = va_arg(ap, int *);
 
-	if (orig_buf_size <
-	    buffer_size - sizeof(struct group) - sizeof(char *)) {
+	if (orig_buf_size + sizeof(struct group) + sizeof(char *) < buffer_size)
+	{
 		*ret_errno = ERANGE;
 		return (NS_RETURN);
+	} else if (buffer_size < sizeof(struct group) + sizeof(char *)) {
+		/*
+		 * nscd(8) sometimes returns buffer_size=1 for nonexistent
+		 * entries.
+		 */
+		*ret_errno = 0;
+		return (NS_NOTFOUND);
 	}
 
 	memcpy(grp, buffer, sizeof(struct group));
 	memcpy(&p, buffer + sizeof(struct group), sizeof(char *));
+
+	if (orig_buf_size + sizeof(struct group) + sizeof(char *) +
+	    _ALIGN(p) - (size_t)p < buffer_size) {
+		*ret_errno = ERANGE;
+		return (NS_RETURN);
+	}
 
 	orig_buf = (char *)_ALIGN(orig_buf);
 	memcpy(orig_buf, buffer + sizeof(struct group) + sizeof(char *) +

Modified: stable/12/lib/libc/gen/getpwent.c
==============================================================================
--- stable/12/lib/libc/gen/getpwent.c	Thu Nov 26 22:49:05 2020	(r368084)
+++ stable/12/lib/libc/gen/getpwent.c	Thu Nov 26 23:34:02 2020	(r368085)
@@ -389,10 +389,17 @@ pwd_unmarshal_func(char *buffer, size_t buffer_size, v
 	orig_buf_size = va_arg(ap, size_t);
 	ret_errno = va_arg(ap, int *);
 
-	if (orig_buf_size <
-	    buffer_size - sizeof(struct passwd) - sizeof(char *)) {
+	if (orig_buf_size + sizeof(struct passwd) + sizeof(char *) <
+	    buffer_size) {
 		*ret_errno = ERANGE;
 		return (NS_RETURN);
+	} else if (buffer_size < sizeof(struct passwd) + sizeof(char *)) {
+		/*
+		 * nscd(8) sometimes returns buffer_size=1 for nonexistent
+		 * entries.
+		 */
+		*ret_errno = 0;
+		return (NS_NOTFOUND);
 	}
 
 	memcpy(pwd, buffer, sizeof(struct passwd));

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202011262334.0AQNY2Mt044289>