Date: Wed, 29 Jul 2015 01:21:06 +0200 From: Baptiste Daroussin <bapt@freebsd.org> To: Bruce Evans <brde@optusnet.com.au> Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org Subject: Re: svn commit: r285985 - in head/usr.sbin/pw: . tests Message-ID: <20150728232106.GG28638@ivaldir.etoilebsd.net> In-Reply-To: <20150729080932.S5059@besplex.bde.org> References: <201507282110.t6SLAx0k035167@repo.freebsd.org> <20150729080932.S5059@besplex.bde.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--4ndw/alBWmZEhfcZ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Jul 29, 2015 at 08:52:52AM +1000, Bruce Evans wrote: > On Tue, 28 Jul 2015, Baptiste Daroussin wrote: >=20 > > Log: > > Check uid/gid used when creating a user/group are not larger than UID_= MAX/GID_MAX > > > > PR: 173977 > > Reported by: nvass@gmx.com >=20 > This is broken in a different way than before. >=20 > > Modified: head/usr.sbin/pw/pw.c > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D > > --- head/usr.sbin/pw/pw.c Tue Jul 28 20:52:10 2015 (r285984) > > +++ head/usr.sbin/pw/pw.c Tue Jul 28 21:10:58 2015 (r285985) > > @@ -269,7 +269,7 @@ main(int argc, char *argv[]) > > } > > if (strspn(optarg, "0123456789") !=3D strlen(optarg)) > > errx(EX_USAGE, "-g expects a number"); > > - id =3D strtonum(optarg, 0, LONG_MAX, &errstr); > > + id =3D strtonum(optarg, 0, GID_MAX, &errstr); >=20 > `id' still has type long. The assignment overflows on 32-bit arches when > the value exceeds 0x7fffffff. That is for half of all valid values. pw > is broken in not supporting these values, but at least it detected them > as errors in the previous version. Old versions implemented this bug > using atoi() with no error checking. So writting a function like strtonum like function with that prototype intmax_t strtonumber(const char *, intmax_t min, intmax_t max, const char *= *); and an unsigned equivalent uintmax_t strtonumber(const char *, uintmax_t min, uintmax_t max, const cha= r **); would do the right thing? Best regards, Bapt --4ndw/alBWmZEhfcZ Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlW4DmIACgkQ8kTtMUmk6EwZ/gCgn/AN+ahJg1D4LUOPWmSHgC9P nAAAmQEWweWAbtcDYfml3rDxoOllsffM =fezR -----END PGP SIGNATURE----- --4ndw/alBWmZEhfcZ--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150728232106.GG28638>