diff options
| author | Jakub Jelinek <jakub@redhat.com> | 2007-01-12 17:11:28 +0000 |
|---|---|---|
| committer | Jakub Jelinek <jakub@redhat.com> | 2007-01-12 17:11:28 +0000 |
| commit | f1985efa522f3b8dad1970363fb6f7fa832c03d8 (patch) | |
| tree | b62a256c42feabc43b3e269c0b632b8c30e27279 /misc | |
| parent | 9a725509fd14ec55c5b8a4bdf84db63301f15844 (diff) | |
| download | glibc-f1985efa522f3b8dad1970363fb6f7fa832c03d8.tar.gz glibc-f1985efa522f3b8dad1970363fb6f7fa832c03d8.tar.xz glibc-f1985efa522f3b8dad1970363fb6f7fa832c03d8.zip | |
* misc/getusershell.c (initshells): Check for integer overflows.
Make strings buffer one bigger as fgets always succeeds when second argument is 1. Don't use calloc for shells array. Disallow / as shell.
Diffstat (limited to 'misc')
| -rw-r--r-- | misc/getusershell.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/misc/getusershell.c b/misc/getusershell.c index 255b579b1a..636da322f9 100644 --- a/misc/getusershell.c +++ b/misc/getusershell.c @@ -98,7 +98,7 @@ initshells() register char **sp, *cp; register FILE *fp; struct stat64 statb; - int flen; + size_t flen; free(shells); shells = NULL; @@ -114,9 +114,11 @@ initshells() okshells[1] = _PATH_CSHELL; return (char **) okshells; } - if ((strings = malloc((u_int)statb.st_size + 1)) == NULL) + if (statb.st_size > ~(size_t)0 / sizeof (char *) * 3) goto init_okshells; - shells = calloc((unsigned)statb.st_size / 3, sizeof (char *)); + if ((strings = malloc(statb.st_size + 2)) == NULL) + goto init_okshells; + shells = malloc(statb.st_size / 3 * sizeof (char *)); if (shells == NULL) { free(strings); strings = NULL; @@ -124,11 +126,11 @@ initshells() } sp = shells; cp = strings; - flen = statb.st_size; + flen = statb.st_size + 2; while (fgets_unlocked(cp, flen - (cp - strings), fp) != NULL) { while (*cp != '#' && *cp != '/' && *cp != '\0') cp++; - if (*cp == '#' || *cp == '\0') + if (*cp == '#' || *cp == '\0' || cp[1] == '\0') continue; *sp++ = cp; while (!isspace(*cp) && *cp != '#' && *cp != '\0') |