Date: Sat, 19 Sep 1998 01:38:17 -0500 (CDT) From: dnelson@emsphone.com (Dan Nelson) To: FreeBSD-gnats-submit@FreeBSD.ORG Subject: bin/7986: bad argument-processing code in su.c Message-ID: <199809190638.BAA25813@dan.emsphone.com>
next in thread | raw e-mail | index | archive | help
>Number: 7986 >Category: bin >Synopsis: bad argument-processing code in su.c >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Sep 18 23:40:00 PDT 1998 >Last-Modified: >Originator: Dan Nelson >Organization: Executive Marketing Services, Inc. >Release: FreeBSD 2.2.7-STABLE i386 >Environment: FreeBSD dan.emsphone.com 2.2.7-STABLE FreeBSD 2.2.7-STABLE #0: Sat Aug 8 15:03:34 CDT 1998 dan@dan.emsphone.com:/usr/src/sys/compile/DAN i386 >Description: The code in /usr/bin/su does not process its commandline correctly. It is possible to pass arguments such that the "user" variable gets assigned to NULL, and a segfault occurs later on. >How-To-Repeat: su -- and see it coredump at: if (strlen(user) > MAXLOGNAME - 1) { >Fix: Convert the argument processing to standard form: a "while(getopt())" loop followed by "if (optind < argc)" blocks, one per argument. Index: su.c =================================================================== RCS file: /home/ncvs/src/usr.bin/su/su.c,v retrieving revision 1.14.2.9 diff -r1.14.2.9 su.c 137,138c137 < while(optind < argc) < if((ch = getopt(argc, argv, ARGSTR)) != -1) --- > while((ch = getopt(argc, argv, ARGSTR)) != -1) 166,167c165,166 < else < { --- > > if (optind < argc) 169,170d167 < break; < } >Audit-Trail: >Unformatted: Dan Nelson To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199809190638.BAA25813>