OLD | NEW |
1 #include <pthread.h> | 1 #include <pthread.h> |
2 #include <byteswap.h> | 2 #include <byteswap.h> |
3 #include <string.h> | 3 #include <string.h> |
4 #include <unistd.h> | 4 #include <unistd.h> |
5 #include "pwf.h" | 5 #include "pwf.h" |
6 #include "nscd.h" | 6 #include "nscd.h" |
7 | 7 |
8 static char *itoa(char *p, uint32_t x) | 8 static char* itoa(char* p, uint32_t x) { |
9 { | 9 // number of digits in a uint32_t + NUL |
10 » // number of digits in a uint32_t + NUL | 10 p += 11; |
11 » p += 11; | 11 *--p = 0; |
12 » *--p = 0; | 12 do { |
13 » do { | 13 *--p = '0' + x % 10; |
14 » » *--p = '0' + x % 10; | 14 x /= 10; |
15 » » x /= 10; | 15 } while (x); |
16 » } while (x); | 16 return p; |
17 » return p; | |
18 } | 17 } |
19 | 18 |
20 int __getpw_a(const char *name, uid_t uid, struct passwd *pw, char **buf, size_t
*size, struct passwd **res) | 19 int __getpw_a(const char* name, |
21 { | 20 uid_t uid, |
22 » FILE *f; | 21 struct passwd* pw, |
23 » int cs; | 22 char** buf, |
24 » int rv = 0; | 23 size_t* size, |
| 24 struct passwd** res) { |
| 25 FILE* f; |
| 26 int cs; |
| 27 int rv = 0; |
25 | 28 |
26 » *res = 0; | 29 *res = 0; |
27 | 30 |
28 » pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs); | 31 pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs); |
29 | 32 |
30 » f = fopen("/etc/passwd", "rbe"); | 33 f = fopen("/etc/passwd", "rbe"); |
31 » if (!f) { | 34 if (!f) { |
32 » » rv = errno; | 35 rv = errno; |
33 » » goto done; | 36 goto done; |
34 » } | 37 } |
35 | 38 |
36 » while (!(rv = __getpwent_a(f, pw, buf, size, res)) && *res) { | 39 while (!(rv = __getpwent_a(f, pw, buf, size, res)) && *res) { |
37 » » if ((name && !strcmp(name, (*res)->pw_name)) | 40 if ((name && !strcmp(name, (*res)->pw_name)) || |
38 » » || (!name && (*res)->pw_uid == uid)) | 41 (!name && (*res)->pw_uid == uid)) |
39 » » » break; | 42 break; |
40 » } | 43 } |
41 » fclose(f); | 44 fclose(f); |
42 | 45 |
43 » if (!*res && (rv == 0 || rv == ENOENT || rv == ENOTDIR)) { | 46 if (!*res && (rv == 0 || rv == ENOENT || rv == ENOTDIR)) { |
44 » » int32_t req = name ? GETPWBYNAME : GETPWBYUID; | 47 int32_t req = name ? GETPWBYNAME : GETPWBYUID; |
45 » » const char *key; | 48 const char* key; |
46 » » int32_t passwdbuf[PW_LEN] = {0}; | 49 int32_t passwdbuf[PW_LEN] = {0}; |
47 » » size_t len = 0; | 50 size_t len = 0; |
48 » » char uidbuf[11] = {0}; | 51 char uidbuf[11] = {0}; |
49 | 52 |
50 » » if (name) { | 53 if (name) { |
51 » » » key = name; | 54 key = name; |
52 » » } else { | 55 } else { |
53 » » » /* uid outside of this range can't be queried with the | 56 /* uid outside of this range can't be queried with the |
54 » » » * nscd interface, but might happen if uid_t ever | 57 * nscd interface, but might happen if uid_t ever |
55 » » » * happens to be a larger type (this is not true as of | 58 * happens to be a larger type (this is not true as of |
56 » » » * now) | 59 * now) |
57 » » » */ | 60 */ |
58 » » » if(uid > UINT32_MAX) { | 61 if (uid > UINT32_MAX) { |
59 » » » » rv = 0; | 62 rv = 0; |
60 » » » » goto done; | 63 goto done; |
61 » » » } | 64 } |
62 » » » key = itoa(uidbuf, uid); | 65 key = itoa(uidbuf, uid); |
63 » » } | 66 } |
64 | 67 |
65 » » f = __nscd_query(req, key, passwdbuf, sizeof passwdbuf, (int[]){
0}); | 68 f = __nscd_query(req, key, passwdbuf, sizeof passwdbuf, (int[]){0}); |
66 » » if (!f) { rv = errno; goto done; } | 69 if (!f) { |
| 70 rv = errno; |
| 71 goto done; |
| 72 } |
67 | 73 |
68 » » if(!passwdbuf[PWFOUND]) { rv = 0; goto cleanup_f; } | 74 if (!passwdbuf[PWFOUND]) { |
| 75 rv = 0; |
| 76 goto cleanup_f; |
| 77 } |
69 | 78 |
70 » » /* A zero length response from nscd is invalid. We ignore | 79 /* A zero length response from nscd is invalid. We ignore |
71 » » * invalid responses and just report an error, rather than | 80 * invalid responses and just report an error, rather than |
72 » » * trying to do something with them. | 81 * trying to do something with them. |
73 » » */ | 82 */ |
74 » » if (!passwdbuf[PWNAMELEN] || !passwdbuf[PWPASSWDLEN] | 83 if (!passwdbuf[PWNAMELEN] || !passwdbuf[PWPASSWDLEN] || |
75 » » || !passwdbuf[PWGECOSLEN] || !passwdbuf[PWDIRLEN] | 84 !passwdbuf[PWGECOSLEN] || !passwdbuf[PWDIRLEN] || |
76 » » || !passwdbuf[PWSHELLLEN]) { | 85 !passwdbuf[PWSHELLLEN]) { |
77 » » » rv = EIO; | 86 rv = EIO; |
78 » » » goto cleanup_f; | 87 goto cleanup_f; |
79 » » } | 88 } |
80 | 89 |
81 » » if ((passwdbuf[PWNAMELEN]|passwdbuf[PWPASSWDLEN] | 90 if ((passwdbuf[PWNAMELEN] | passwdbuf[PWPASSWDLEN] | passwdbuf[PWGECOSLEN] | |
82 » » |passwdbuf[PWGECOSLEN]|passwdbuf[PWDIRLEN] | 91 passwdbuf[PWDIRLEN] | passwdbuf[PWSHELLLEN]) >= SIZE_MAX / 8) { |
83 » » |passwdbuf[PWSHELLLEN]) >= SIZE_MAX/8) { | 92 rv = ENOMEM; |
84 » » » rv = ENOMEM; | 93 goto cleanup_f; |
85 » » » goto cleanup_f; | 94 } |
86 » » } | |
87 | 95 |
88 » » len = passwdbuf[PWNAMELEN] + passwdbuf[PWPASSWDLEN] | 96 len = passwdbuf[PWNAMELEN] + passwdbuf[PWPASSWDLEN] + |
89 » » + passwdbuf[PWGECOSLEN] + passwdbuf[PWDIRLEN] | 97 passwdbuf[PWGECOSLEN] + passwdbuf[PWDIRLEN] + passwdbuf[PWSHELLLEN]; |
90 » » + passwdbuf[PWSHELLLEN]; | |
91 | 98 |
92 » » if (len > *size || !*buf) { | 99 if (len > *size || !*buf) { |
93 » » » char *tmp = realloc(*buf, len); | 100 char* tmp = realloc(*buf, len); |
94 » » » if (!tmp) { | 101 if (!tmp) { |
95 » » » » rv = errno; | 102 rv = errno; |
96 » » » » goto cleanup_f; | 103 goto cleanup_f; |
97 » » » } | 104 } |
98 » » » *buf = tmp; | 105 *buf = tmp; |
99 » » » *size = len; | 106 *size = len; |
100 » » } | 107 } |
101 | 108 |
102 » » if (!fread(*buf, len, 1, f)) { | 109 if (!fread(*buf, len, 1, f)) { |
103 » » » rv = ferror(f) ? errno : EIO; | 110 rv = ferror(f) ? errno : EIO; |
104 » » » goto cleanup_f; | 111 goto cleanup_f; |
105 » » } | 112 } |
106 | 113 |
107 » » pw->pw_name = *buf; | 114 pw->pw_name = *buf; |
108 » » pw->pw_passwd = pw->pw_name + passwdbuf[PWNAMELEN]; | 115 pw->pw_passwd = pw->pw_name + passwdbuf[PWNAMELEN]; |
109 » » pw->pw_gecos = pw->pw_passwd + passwdbuf[PWPASSWDLEN]; | 116 pw->pw_gecos = pw->pw_passwd + passwdbuf[PWPASSWDLEN]; |
110 » » pw->pw_dir = pw->pw_gecos + passwdbuf[PWGECOSLEN]; | 117 pw->pw_dir = pw->pw_gecos + passwdbuf[PWGECOSLEN]; |
111 » » pw->pw_shell = pw->pw_dir + passwdbuf[PWDIRLEN]; | 118 pw->pw_shell = pw->pw_dir + passwdbuf[PWDIRLEN]; |
112 » » pw->pw_uid = passwdbuf[PWUID]; | 119 pw->pw_uid = passwdbuf[PWUID]; |
113 » » pw->pw_gid = passwdbuf[PWGID]; | 120 pw->pw_gid = passwdbuf[PWGID]; |
114 | 121 |
115 » » /* Don't assume that nscd made sure to null terminate strings. | 122 /* Don't assume that nscd made sure to null terminate strings. |
116 » » * It's supposed to, but malicious nscd should be ignored | 123 * It's supposed to, but malicious nscd should be ignored |
117 » » * rather than causing a crash. | 124 * rather than causing a crash. |
118 » » */ | 125 */ |
119 » » if (pw->pw_passwd[-1] || pw->pw_gecos[-1] || pw->pw_dir[-1] | 126 if (pw->pw_passwd[-1] || pw->pw_gecos[-1] || pw->pw_dir[-1] || |
120 » » || pw->pw_shell[passwdbuf[PWSHELLLEN]-1]) { | 127 pw->pw_shell[passwdbuf[PWSHELLLEN] - 1]) { |
121 » » » rv = EIO; | 128 rv = EIO; |
122 » » » goto cleanup_f; | 129 goto cleanup_f; |
123 » » } | 130 } |
124 | 131 |
125 » » if ((name && strcmp(name, pw->pw_name)) | 132 if ((name && strcmp(name, pw->pw_name)) || (!name && uid != pw->pw_uid)) { |
126 » » || (!name && uid != pw->pw_uid)) { | 133 rv = EIO; |
127 » » » rv = EIO; | 134 goto cleanup_f; |
128 » » » goto cleanup_f; | 135 } |
129 » » } | |
130 | 136 |
131 | 137 *res = pw; |
132 » » *res = pw; | 138 cleanup_f: |
133 cleanup_f: | 139 fclose(f); |
134 » » fclose(f); | 140 goto done; |
135 » » goto done; | 141 } |
136 » } | |
137 | 142 |
138 done: | 143 done: |
139 » pthread_setcancelstate(cs, 0); | 144 pthread_setcancelstate(cs, 0); |
140 » if (rv) errno = rv; | 145 if (rv) |
141 » return rv; | 146 errno = rv; |
| 147 return rv; |
142 } | 148 } |
OLD | NEW |