| OLD | NEW |
| 1 #include <pthread.h> | 1 #include <pthread.h> |
| 2 #include <byteswap.h> | 2 #include <byteswap.h> |
| 3 #include <string.h> | 3 #include <string.h> |
| 4 #include <unistd.h> | 4 #include <unistd.h> |
| 5 #include "pwf.h" | 5 #include "pwf.h" |
| 6 #include "nscd.h" | 6 #include "nscd.h" |
| 7 | 7 |
| 8 static char *itoa(char *p, uint32_t x) | 8 static char* itoa(char* p, uint32_t x) { |
| 9 { | 9 // number of digits in a uint32_t + NUL |
| 10 » // number of digits in a uint32_t + NUL | 10 p += 11; |
| 11 » p += 11; | 11 *--p = 0; |
| 12 » *--p = 0; | 12 do { |
| 13 » do { | 13 *--p = '0' + x % 10; |
| 14 » » *--p = '0' + x % 10; | 14 x /= 10; |
| 15 » » x /= 10; | 15 } while (x); |
| 16 » } while (x); | 16 return p; |
| 17 » return p; | |
| 18 } | 17 } |
| 19 | 18 |
| 20 int __getpw_a(const char *name, uid_t uid, struct passwd *pw, char **buf, size_t
*size, struct passwd **res) | 19 int __getpw_a(const char* name, |
| 21 { | 20 uid_t uid, |
| 22 » FILE *f; | 21 struct passwd* pw, |
| 23 » int cs; | 22 char** buf, |
| 24 » int rv = 0; | 23 size_t* size, |
| 24 struct passwd** res) { |
| 25 FILE* f; |
| 26 int cs; |
| 27 int rv = 0; |
| 25 | 28 |
| 26 » *res = 0; | 29 *res = 0; |
| 27 | 30 |
| 28 » pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs); | 31 pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs); |
| 29 | 32 |
| 30 » f = fopen("/etc/passwd", "rbe"); | 33 f = fopen("/etc/passwd", "rbe"); |
| 31 » if (!f) { | 34 if (!f) { |
| 32 » » rv = errno; | 35 rv = errno; |
| 33 » » goto done; | 36 goto done; |
| 34 » } | 37 } |
| 35 | 38 |
| 36 » while (!(rv = __getpwent_a(f, pw, buf, size, res)) && *res) { | 39 while (!(rv = __getpwent_a(f, pw, buf, size, res)) && *res) { |
| 37 » » if ((name && !strcmp(name, (*res)->pw_name)) | 40 if ((name && !strcmp(name, (*res)->pw_name)) || |
| 38 » » || (!name && (*res)->pw_uid == uid)) | 41 (!name && (*res)->pw_uid == uid)) |
| 39 » » » break; | 42 break; |
| 40 » } | 43 } |
| 41 » fclose(f); | 44 fclose(f); |
| 42 | 45 |
| 43 » if (!*res && (rv == 0 || rv == ENOENT || rv == ENOTDIR)) { | 46 if (!*res && (rv == 0 || rv == ENOENT || rv == ENOTDIR)) { |
| 44 » » int32_t req = name ? GETPWBYNAME : GETPWBYUID; | 47 int32_t req = name ? GETPWBYNAME : GETPWBYUID; |
| 45 » » const char *key; | 48 const char* key; |
| 46 » » int32_t passwdbuf[PW_LEN] = {0}; | 49 int32_t passwdbuf[PW_LEN] = {0}; |
| 47 » » size_t len = 0; | 50 size_t len = 0; |
| 48 » » char uidbuf[11] = {0}; | 51 char uidbuf[11] = {0}; |
| 49 | 52 |
| 50 » » if (name) { | 53 if (name) { |
| 51 » » » key = name; | 54 key = name; |
| 52 » » } else { | 55 } else { |
| 53 » » » /* uid outside of this range can't be queried with the | 56 /* uid outside of this range can't be queried with the |
| 54 » » » * nscd interface, but might happen if uid_t ever | 57 * nscd interface, but might happen if uid_t ever |
| 55 » » » * happens to be a larger type (this is not true as of | 58 * happens to be a larger type (this is not true as of |
| 56 » » » * now) | 59 * now) |
| 57 » » » */ | 60 */ |
| 58 » » » if(uid > UINT32_MAX) { | 61 if (uid > UINT32_MAX) { |
| 59 » » » » rv = 0; | 62 rv = 0; |
| 60 » » » » goto done; | 63 goto done; |
| 61 » » » } | 64 } |
| 62 » » » key = itoa(uidbuf, uid); | 65 key = itoa(uidbuf, uid); |
| 63 » » } | 66 } |
| 64 | 67 |
| 65 » » f = __nscd_query(req, key, passwdbuf, sizeof passwdbuf, (int[]){
0}); | 68 f = __nscd_query(req, key, passwdbuf, sizeof passwdbuf, (int[]){0}); |
| 66 » » if (!f) { rv = errno; goto done; } | 69 if (!f) { |
| 70 rv = errno; |
| 71 goto done; |
| 72 } |
| 67 | 73 |
| 68 » » if(!passwdbuf[PWFOUND]) { rv = 0; goto cleanup_f; } | 74 if (!passwdbuf[PWFOUND]) { |
| 75 rv = 0; |
| 76 goto cleanup_f; |
| 77 } |
| 69 | 78 |
| 70 » » /* A zero length response from nscd is invalid. We ignore | 79 /* A zero length response from nscd is invalid. We ignore |
| 71 » » * invalid responses and just report an error, rather than | 80 * invalid responses and just report an error, rather than |
| 72 » » * trying to do something with them. | 81 * trying to do something with them. |
| 73 » » */ | 82 */ |
| 74 » » if (!passwdbuf[PWNAMELEN] || !passwdbuf[PWPASSWDLEN] | 83 if (!passwdbuf[PWNAMELEN] || !passwdbuf[PWPASSWDLEN] || |
| 75 » » || !passwdbuf[PWGECOSLEN] || !passwdbuf[PWDIRLEN] | 84 !passwdbuf[PWGECOSLEN] || !passwdbuf[PWDIRLEN] || |
| 76 » » || !passwdbuf[PWSHELLLEN]) { | 85 !passwdbuf[PWSHELLLEN]) { |
| 77 » » » rv = EIO; | 86 rv = EIO; |
| 78 » » » goto cleanup_f; | 87 goto cleanup_f; |
| 79 » » } | 88 } |
| 80 | 89 |
| 81 » » if ((passwdbuf[PWNAMELEN]|passwdbuf[PWPASSWDLEN] | 90 if ((passwdbuf[PWNAMELEN] | passwdbuf[PWPASSWDLEN] | passwdbuf[PWGECOSLEN] | |
| 82 » » |passwdbuf[PWGECOSLEN]|passwdbuf[PWDIRLEN] | 91 passwdbuf[PWDIRLEN] | passwdbuf[PWSHELLLEN]) >= SIZE_MAX / 8) { |
| 83 » » |passwdbuf[PWSHELLLEN]) >= SIZE_MAX/8) { | 92 rv = ENOMEM; |
| 84 » » » rv = ENOMEM; | 93 goto cleanup_f; |
| 85 » » » goto cleanup_f; | 94 } |
| 86 » » } | |
| 87 | 95 |
| 88 » » len = passwdbuf[PWNAMELEN] + passwdbuf[PWPASSWDLEN] | 96 len = passwdbuf[PWNAMELEN] + passwdbuf[PWPASSWDLEN] + |
| 89 » » + passwdbuf[PWGECOSLEN] + passwdbuf[PWDIRLEN] | 97 passwdbuf[PWGECOSLEN] + passwdbuf[PWDIRLEN] + passwdbuf[PWSHELLLEN]; |
| 90 » » + passwdbuf[PWSHELLLEN]; | |
| 91 | 98 |
| 92 » » if (len > *size || !*buf) { | 99 if (len > *size || !*buf) { |
| 93 » » » char *tmp = realloc(*buf, len); | 100 char* tmp = realloc(*buf, len); |
| 94 » » » if (!tmp) { | 101 if (!tmp) { |
| 95 » » » » rv = errno; | 102 rv = errno; |
| 96 » » » » goto cleanup_f; | 103 goto cleanup_f; |
| 97 » » » } | 104 } |
| 98 » » » *buf = tmp; | 105 *buf = tmp; |
| 99 » » » *size = len; | 106 *size = len; |
| 100 » » } | 107 } |
| 101 | 108 |
| 102 » » if (!fread(*buf, len, 1, f)) { | 109 if (!fread(*buf, len, 1, f)) { |
| 103 » » » rv = ferror(f) ? errno : EIO; | 110 rv = ferror(f) ? errno : EIO; |
| 104 » » » goto cleanup_f; | 111 goto cleanup_f; |
| 105 » » } | 112 } |
| 106 | 113 |
| 107 » » pw->pw_name = *buf; | 114 pw->pw_name = *buf; |
| 108 » » pw->pw_passwd = pw->pw_name + passwdbuf[PWNAMELEN]; | 115 pw->pw_passwd = pw->pw_name + passwdbuf[PWNAMELEN]; |
| 109 » » pw->pw_gecos = pw->pw_passwd + passwdbuf[PWPASSWDLEN]; | 116 pw->pw_gecos = pw->pw_passwd + passwdbuf[PWPASSWDLEN]; |
| 110 » » pw->pw_dir = pw->pw_gecos + passwdbuf[PWGECOSLEN]; | 117 pw->pw_dir = pw->pw_gecos + passwdbuf[PWGECOSLEN]; |
| 111 » » pw->pw_shell = pw->pw_dir + passwdbuf[PWDIRLEN]; | 118 pw->pw_shell = pw->pw_dir + passwdbuf[PWDIRLEN]; |
| 112 » » pw->pw_uid = passwdbuf[PWUID]; | 119 pw->pw_uid = passwdbuf[PWUID]; |
| 113 » » pw->pw_gid = passwdbuf[PWGID]; | 120 pw->pw_gid = passwdbuf[PWGID]; |
| 114 | 121 |
| 115 » » /* Don't assume that nscd made sure to null terminate strings. | 122 /* Don't assume that nscd made sure to null terminate strings. |
| 116 » » * It's supposed to, but malicious nscd should be ignored | 123 * It's supposed to, but malicious nscd should be ignored |
| 117 » » * rather than causing a crash. | 124 * rather than causing a crash. |
| 118 » » */ | 125 */ |
| 119 » » if (pw->pw_passwd[-1] || pw->pw_gecos[-1] || pw->pw_dir[-1] | 126 if (pw->pw_passwd[-1] || pw->pw_gecos[-1] || pw->pw_dir[-1] || |
| 120 » » || pw->pw_shell[passwdbuf[PWSHELLLEN]-1]) { | 127 pw->pw_shell[passwdbuf[PWSHELLLEN] - 1]) { |
| 121 » » » rv = EIO; | 128 rv = EIO; |
| 122 » » » goto cleanup_f; | 129 goto cleanup_f; |
| 123 » » } | 130 } |
| 124 | 131 |
| 125 » » if ((name && strcmp(name, pw->pw_name)) | 132 if ((name && strcmp(name, pw->pw_name)) || (!name && uid != pw->pw_uid)) { |
| 126 » » || (!name && uid != pw->pw_uid)) { | 133 rv = EIO; |
| 127 » » » rv = EIO; | 134 goto cleanup_f; |
| 128 » » » goto cleanup_f; | 135 } |
| 129 » » } | |
| 130 | 136 |
| 131 | 137 *res = pw; |
| 132 » » *res = pw; | 138 cleanup_f: |
| 133 cleanup_f: | 139 fclose(f); |
| 134 » » fclose(f); | 140 goto done; |
| 135 » » goto done; | 141 } |
| 136 » } | |
| 137 | 142 |
| 138 done: | 143 done: |
| 139 » pthread_setcancelstate(cs, 0); | 144 pthread_setcancelstate(cs, 0); |
| 140 » if (rv) errno = rv; | 145 if (rv) |
| 141 » return rv; | 146 errno = rv; |
| 147 return rv; |
| 142 } | 148 } |
| OLD | NEW |