Date: Sat, 19 Sep 1998 01:38:17 -0500 (CDT) From: dnelson@emsphone.com (Dan Nelson) To: FreeBSD-gnats-submit@FreeBSD.ORG Subject: bin/7986: bad argument-processing code in su.c Message-ID: <199809190638.BAA25813@dan.emsphone.com>
next in thread | raw e-mail | index | archive | help
>Number: 7986
>Category: bin
>Synopsis: bad argument-processing code in su.c
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Fri Sep 18 23:40:00 PDT 1998
>Last-Modified:
>Originator: Dan Nelson
>Organization:
Executive Marketing Services, Inc.
>Release: FreeBSD 2.2.7-STABLE i386
>Environment:
FreeBSD dan.emsphone.com 2.2.7-STABLE FreeBSD 2.2.7-STABLE #0: Sat Aug 8 15:03:34 CDT 1998 dan@dan.emsphone.com:/usr/src/sys/compile/DAN i386
>Description:
The code in /usr/bin/su does not process its commandline correctly. It
is possible to pass arguments such that the "user" variable gets
assigned to NULL, and a segfault occurs later on.
>How-To-Repeat:
su --
and see it coredump at:
if (strlen(user) > MAXLOGNAME - 1) {
>Fix:
Convert the argument processing to standard form: a "while(getopt())"
loop followed by "if (optind < argc)" blocks, one per argument.
Index: su.c
===================================================================
RCS file: /home/ncvs/src/usr.bin/su/su.c,v
retrieving revision 1.14.2.9
diff -r1.14.2.9 su.c
137,138c137
< while(optind < argc)
< if((ch = getopt(argc, argv, ARGSTR)) != -1)
---
> while((ch = getopt(argc, argv, ARGSTR)) != -1)
166,167c165,166
< else
< {
---
>
> if (optind < argc)
169,170d167
< break;
< }
>Audit-Trail:
>Unformatted:
Dan Nelson
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199809190638.BAA25813>