From patchwork Tue Jan 15 15:54:52 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 1025275 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=sourceware.org (client-ip=209.132.180.131; helo=sourceware.org; envelope-from=libc-alpha-return-99270-incoming=patchwork.ozlabs.org@sourceware.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b="se71Aann"; dkim-atps=neutral Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43fFKR1sCkz9sD9 for ; Wed, 16 Jan 2019 02:55:07 +1100 (AEDT) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:date:message-id:mime-version :content-type; q=dns; s=default; b=RyRtIs8sY12eiMsEInF/jS1OyDf4w Q4GfL+giGPN7u3EvBNi3/rsozlYctPbFxq10LFtTGGytALKO1lRyXmVPE9MUskWw BWS9x1eKkk/heVF6nj0mQz1sRTzLv59MA8vI5ZQiSoybWX7F2dn6QSGA9DpU1u7C n3Yxzr6zWRe2kk= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:date:message-id:mime-version :content-type; s=default; bh=2KaEnmFRcRHQHFvfVEDbzc4jbNk=; b=se7 1AannPDpGJE/IBcKMNWCP8qLejG6Q5UV5jRrnW9abOc1ISRW3qD2Rb0Rknf47jNQ JiHexlmc333334o72RxoGaVcIyHTdxjIrP9Tb+Da6fzfQm2BftcDCTzyVvQ5TOS0 yXKJnnsezbyV7chKitWdToVD+neHhro+oqUesQdo= Received: (qmail 70987 invoked by alias); 15 Jan 2019 15:55:01 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 70592 invoked by uid 89); 15 Jan 2019 15:55:01 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-26.9 required=5.0 tests=BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_SHORT, SPF_HELO_PASS autolearn=ham version=3.3.2 spammy=conf X-HELO: mx1.redhat.com From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH] nss_files: Fix /etc/aliases null pointer dereference [BZ #24059] Date: Tue, 15 Jan 2019 16:54:52 +0100 Message-ID: <87a7k1531v.fsf@oldenburg2.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 If /etc/aliases ends with a continuation line (a line that starts with whitespace) which does not have a training newline character, the file parser would crash due to a null pointer dereference. 2019-01-15 Florian Weimer [BZ #24059] * nss/nss_files/files-alias.c (get_next_alias): Handle continuation line without newline at the end. * nss/tst-nss-files-alias-truncated.c: New file. * nss/Makefile [$(build-shared)] (tests): Add tst-nss-files-alias-truncated. (tst-nss-files-alias-truncated): Link with libnss_files.so. * support/namespace.h (struct support_chroot_configuration): Add aliases member. (struct support_chroot): Add path_aliases member. * support/support_chroot.c (support_chroot_create): Handle aliases. (support_chroot_free): Free path_aliases. Reviewed-by: Carlos O'Donell diff --git a/nss/Makefile b/nss/Makefile index 0fa28f0c5e..e66e01d45a 100644 --- a/nss/Makefile +++ b/nss/Makefile @@ -68,6 +68,7 @@ tests += tst-nss-files-hosts-erange tests += tst-nss-files-hosts-multi tests += tst-nss-files-hosts-getent tests += tst-nss-files-alias-leak +tests += tst-nss-files-alias-truncated endif # If we have a thread library then we can test cancellation against @@ -176,3 +177,4 @@ $(objpfx)tst-nss-files-hosts-multi: $(libdl) $(objpfx)tst-nss-files-hosts-getent: $(libdl) $(objpfx)tst-nss-files-alias-leak: $(libdl) $(objpfx)tst-nss-files-alias-leak.out: $(objpfx)/libnss_files.so +$(objpfx)tst-nss-files-alias-truncated: $(objpfx)/libnss_files.so diff --git a/nss/nss_files/files-alias.c b/nss/nss_files/files-alias.c index 540eb9c678..34d7aa84cc 100644 --- a/nss/nss_files/files-alias.c +++ b/nss/nss_files/files-alias.c @@ -333,6 +333,16 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result, can be ignored. */ first_unused[room_left - 1] = '\xff'; line = fgets_unlocked (first_unused, room_left, stream); + if (line == NULL) + { + /* Continuation line without any data and + without a newline at the end. Treat it as an + empty line and retry, reaching EOF once + more. */ + line = first_unused; + *line = '\0'; + continue; + } if (first_unused[room_left - 1] != '\xff') goto no_more_room; cp = strpbrk (line, "#\n"); diff --git a/nss/tst-nss-files-alias-truncated.c b/nss/tst-nss-files-alias-truncated.c new file mode 100644 index 0000000000..2d6aba3c0e --- /dev/null +++ b/nss/tst-nss-files-alias-truncated.c @@ -0,0 +1,66 @@ +/* Check handling of missing end-of-line at end of /etc/aliases (bug 24059). + Copyright (C) 2019 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include + +static void +in_chroot (void *closure) +{ + struct support_chroot *chroot_env = closure; + xchroot (chroot_env->path_chroot); + + struct aliasent *e = getaliasbyname ("user1"); + TEST_VERIFY_EXIT (e != NULL); + TEST_COMPARE_STRING (e->alias_name, "user1"); + TEST_COMPARE (e->alias_members_len, 1); + TEST_VERIFY_EXIT (e->alias_members != NULL); + TEST_COMPARE_STRING (e->alias_members[0], "alias1"); + TEST_VERIFY (e->alias_local); +} + +static int +do_test (void) +{ + /* nss_files has already been loaded via DT_NEEDED, outside the + chroot. */ + __nss_configure_lookup ("aliases", "files"); + + support_become_root (); + if (!support_can_chroot ()) + return EXIT_UNSUPPORTED; + + struct support_chroot *chroot_env = support_chroot_create + ((struct support_chroot_configuration) + { + .aliases = "user1: alias1,\n" + " " /* Continuation line, but no \n. */ + }); + + support_isolate_in_subprocess (in_chroot, chroot_env); + + support_chroot_free (chroot_env); + return 0; +} + +#include diff --git a/support/namespace.h b/support/namespace.h index f93754934f..4770cf9e90 100644 --- a/support/namespace.h +++ b/support/namespace.h @@ -74,6 +74,7 @@ struct support_chroot_configuration const char *resolv_conf; /* /etc/resolv.conf. */ const char *hosts; /* /etc/hosts. */ const char *host_conf; /* /etc/host.conf. */ + const char *aliases; /* /etc/aliases. */ }; /* The result of the creation of a chroot. */ @@ -90,6 +91,7 @@ struct support_chroot char *path_resolv_conf; /* /etc/resolv.conf. */ char *path_hosts; /* /etc/hosts. */ char *path_host_conf; /* /etc/host.conf. */ + char *path_aliases; /* /etc/aliases. */ }; /* Create a chroot environment. The returned data should be freed diff --git a/support/support_chroot.c b/support/support_chroot.c index b866b89a18..412ec33f53 100644 --- a/support/support_chroot.c +++ b/support/support_chroot.c @@ -56,6 +56,7 @@ support_chroot_create (struct support_chroot_configuration conf) &chroot->path_resolv_conf); write_file (path_etc, "hosts", conf.hosts, &chroot->path_hosts); write_file (path_etc, "host.conf", conf.host_conf, &chroot->path_host_conf); + write_file (path_etc, "aliases", conf.aliases, &chroot->path_aliases); free (path_etc); @@ -77,5 +78,6 @@ support_chroot_free (struct support_chroot *chroot) free (chroot->path_resolv_conf); free (chroot->path_hosts); free (chroot->path_host_conf); + free (chroot->path_aliases); free (chroot); }