Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 29 Jul 2015 01:21:06 +0200
From:      Baptiste Daroussin <bapt@freebsd.org>
To:        Bruce Evans <brde@optusnet.com.au>
Cc:        svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org
Subject:   Re: svn commit: r285985 - in head/usr.sbin/pw: . tests
Message-ID:  <20150728232106.GG28638@ivaldir.etoilebsd.net>
In-Reply-To: <20150729080932.S5059@besplex.bde.org>
References:  <201507282110.t6SLAx0k035167@repo.freebsd.org> <20150729080932.S5059@besplex.bde.org>

next in thread | previous in thread | raw e-mail | index | archive | help

--4ndw/alBWmZEhfcZ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Jul 29, 2015 at 08:52:52AM +1000, Bruce Evans wrote:
> On Tue, 28 Jul 2015, Baptiste Daroussin wrote:
>=20
> > Log:
> >  Check uid/gid used when creating a user/group are not larger than UID_=
MAX/GID_MAX
> >
> >  PR:		173977
> >  Reported by:	nvass@gmx.com
>=20
> This is broken in a different way than before.
>=20
> > Modified: head/usr.sbin/pw/pw.c
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D
> > --- head/usr.sbin/pw/pw.c	Tue Jul 28 20:52:10 2015	(r285984)
> > +++ head/usr.sbin/pw/pw.c	Tue Jul 28 21:10:58 2015	(r285985)
> > @@ -269,7 +269,7 @@ main(int argc, char *argv[])
> > 			}
> > 			if (strspn(optarg, "0123456789") !=3D strlen(optarg))
> > 				errx(EX_USAGE, "-g expects a number");
> > -			id =3D strtonum(optarg, 0, LONG_MAX, &errstr);
> > +			id =3D strtonum(optarg, 0, GID_MAX, &errstr);
>=20
> `id' still has type long.  The assignment overflows on 32-bit arches when
> the value exceeds 0x7fffffff.  That is for half of all valid values.  pw
> is broken in not supporting these values, but at least it detected them
> as errors in the previous version.  Old versions implemented this bug
> using atoi() with no error checking.

So writting a function like strtonum like function with that prototype
intmax_t strtonumber(const char *, intmax_t min, intmax_t max, const char *=
*);
and an unsigned equivalent
uintmax_t strtonumber(const char *, uintmax_t min, uintmax_t max, const cha=
r **);

would do the right thing?

Best regards,
Bapt

--4ndw/alBWmZEhfcZ
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlW4DmIACgkQ8kTtMUmk6EwZ/gCgn/AN+ahJg1D4LUOPWmSHgC9P
nAAAmQEWweWAbtcDYfml3rDxoOllsffM
=fezR
-----END PGP SIGNATURE-----

--4ndw/alBWmZEhfcZ--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150728232106.GG28638>