* [PATCH] login: prevent OOB read on illegal /etc/hushlogins
@ 2017-03-12 16:49 Tobias Stoeckmann
2017-03-13 12:08 ` Karel Zak
0 siblings, 1 reply; 2+ messages in thread
From: Tobias Stoeckmann @ 2017-03-12 16:49 UTC (permalink / raw)
To: util-linux
If the file /etc/hushlogins exists and a line starts with '\0', the
login tools are prone to an off-by-one read.
I see no reliability issue with this, as it would clearly need a
hostile action from a system administrator. But for the sake of
correctness, I've sent this patch nonetheless.
---
login-utils/logindefs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/login-utils/logindefs.c b/login-utils/logindefs.c
index f02c4752d..213ff8d25 100644
--- a/login-utils/logindefs.c
+++ b/login-utils/logindefs.c
@@ -344,7 +344,8 @@ int get_hushlogin_status(struct passwd *pwd, int force_check)
continue; /* ignore errors... */
while (ok == 0 && fgets(buf, sizeof(buf), f)) {
- buf[strlen(buf) - 1] = '\0';
+ if (buf[0] != '\0')
+ buf[strlen(buf) - 1] = '\0';
ok = !strcmp(buf, *buf == '/' ? pwd->pw_shell :
pwd->pw_name);
}
--
2.12.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] login: prevent OOB read on illegal /etc/hushlogins
2017-03-12 16:49 [PATCH] login: prevent OOB read on illegal /etc/hushlogins Tobias Stoeckmann
@ 2017-03-13 12:08 ` Karel Zak
0 siblings, 0 replies; 2+ messages in thread
From: Karel Zak @ 2017-03-13 12:08 UTC (permalink / raw)
To: Tobias Stoeckmann; +Cc: util-linux
On Sun, Mar 12, 2017 at 05:49:45PM +0100, Tobias Stoeckmann wrote:
> login-utils/logindefs.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Applied, thanks.
Karel
--
Karel Zak <kzak@redhat.com>
http://karelzak.blogspot.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-03-13 12:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-12 16:49 [PATCH] login: prevent OOB read on illegal /etc/hushlogins Tobias Stoeckmann
2017-03-13 12:08 ` Karel Zak
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox