From owner-svn-src-head@freebsd.org Sat Sep 19 19:08:28 2020 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4F4633EC2FC; Sat, 19 Sep 2020 19:08:28 +0000 (UTC) (envelope-from asomers@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Bv0bc1NXDz4Mhr; Sat, 19 Sep 2020 19:08:28 +0000 (UTC) (envelope-from asomers@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 13B7D10CB7; Sat, 19 Sep 2020 19:08:28 +0000 (UTC) (envelope-from asomers@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 08JJ8R2j016915; Sat, 19 Sep 2020 19:08:27 GMT (envelope-from asomers@FreeBSD.org) Received: (from asomers@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 08JJ8RUU016910; Sat, 19 Sep 2020 19:08:27 GMT (envelope-from asomers@FreeBSD.org) Message-Id: <202009191908.08JJ8RUU016910@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: asomers set sender to asomers@FreeBSD.org using -f From: Alan Somers Date: Sat, 19 Sep 2020 19:08:27 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r365910 - head/lib/libc/gen X-SVN-Group: head X-SVN-Commit-Author: asomers X-SVN-Commit-Paths: head/lib/libc/gen X-SVN-Commit-Revision: 365910 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Sep 2020 19:08:28 -0000 Author: asomers Date: Sat Sep 19 19:08:27 2020 New Revision: 365910 URL: https://svnweb.freebsd.org/changeset/base/365910 Log: fix integer underflow in getgrnam_r and getpwnam_r Sometimes nscd(8) will return a 1-byte buffer for a nonexistent entry. This triggered an integer underflow in grp_unmarshal_func, causing getgrnam_r to return ERANGE instead of 0. Fix the user's buffer size check, and add a correct check for a too-small nscd buffer. PR: 248932 Event: September 2020 Bugathon Reviewed by: markj MFC after: 2 weeks Sponsored by: Axcient Differential Revision: https://reviews.freebsd.org/D26204 Modified: head/lib/libc/gen/getgrent.c head/lib/libc/gen/getpwent.c Modified: head/lib/libc/gen/getgrent.c ============================================================================== --- head/lib/libc/gen/getgrent.c Sat Sep 19 18:25:52 2020 (r365909) +++ head/lib/libc/gen/getgrent.c Sat Sep 19 19:08:27 2020 (r365910) @@ -334,14 +334,27 @@ grp_unmarshal_func(char *buffer, size_t buffer_size, v orig_buf_size = va_arg(ap, size_t); ret_errno = va_arg(ap, int *); - if (orig_buf_size < - buffer_size - sizeof(struct group) - sizeof(char *)) { + if (orig_buf_size + sizeof(struct group) + sizeof(char *) < buffer_size) + { *ret_errno = ERANGE; return (NS_RETURN); + } else if (buffer_size < sizeof(struct group) + sizeof(char *)) { + /* + * nscd(8) sometimes returns buffer_size=1 for nonexistent + * entries. + */ + *ret_errno = 0; + return (NS_NOTFOUND); } memcpy(grp, buffer, sizeof(struct group)); memcpy(&p, buffer + sizeof(struct group), sizeof(char *)); + + if (orig_buf_size + sizeof(struct group) + sizeof(char *) + + _ALIGN(p) - (size_t)p < buffer_size) { + *ret_errno = ERANGE; + return (NS_RETURN); + } orig_buf = (char *)_ALIGN(orig_buf); memcpy(orig_buf, buffer + sizeof(struct group) + sizeof(char *) + Modified: head/lib/libc/gen/getpwent.c ============================================================================== --- head/lib/libc/gen/getpwent.c Sat Sep 19 18:25:52 2020 (r365909) +++ head/lib/libc/gen/getpwent.c Sat Sep 19 19:08:27 2020 (r365910) @@ -389,10 +389,17 @@ pwd_unmarshal_func(char *buffer, size_t buffer_size, v orig_buf_size = va_arg(ap, size_t); ret_errno = va_arg(ap, int *); - if (orig_buf_size < - buffer_size - sizeof(struct passwd) - sizeof(char *)) { + if (orig_buf_size + sizeof(struct passwd) + sizeof(char *) < + buffer_size) { *ret_errno = ERANGE; return (NS_RETURN); + } else if (buffer_size < sizeof(struct passwd) + sizeof(char *)) { + /* + * nscd(8) sometimes returns buffer_size=1 for nonexistent + * entries. + */ + *ret_errno = 0; + return (NS_NOTFOUND); } memcpy(pwd, buffer, sizeof(struct passwd));