diff options
author | Ulrich Drepper <drepper@redhat.com> | 2004-09-12 20:38:38 +0000 |
---|---|---|
committer | Ulrich Drepper <drepper@redhat.com> | 2004-09-12 20:38:38 +0000 |
commit | 20f8e6663accb3d318630e8ec4a08ed37521fce6 (patch) | |
tree | a780fced9cb6d492f91e89edbefa791a383e8572 /nis/nss_compat/compat-initgroups.c | |
parent | ccc63b07082c257ffc6fe0b0bbf770283bb44e98 (diff) | |
download | glibc-20f8e6663accb3d318630e8ec4a08ed37521fce6.tar.gz glibc-20f8e6663accb3d318630e8ec4a08ed37521fce6.tar.xz glibc-20f8e6663accb3d318630e8ec4a08ed37521fce6.zip |
Update.
2004-09-11 Thorsten Kukuk <kukuk@suse.de> * nis/nss_compat/compat-grp.c: Check that buflen is greater zero before writing data into the buffer with negative offset. * nis/nss_compat/compat-initgroups.c: Likewise. * nis/nss_compat/compat-pwd.c: Likewise. * nis/nss_compat/compat-spwd.c Likewise.
Diffstat (limited to 'nis/nss_compat/compat-initgroups.c')
-rw-r--r-- | nis/nss_compat/compat-initgroups.c | 24 |
1 files changed, 14 insertions, 10 deletions
diff --git a/nis/nss_compat/compat-initgroups.c b/nis/nss_compat/compat-initgroups.c index 100febc672..9574ea7c0b 100644 --- a/nis/nss_compat/compat-initgroups.c +++ b/nis/nss_compat/compat-initgroups.c @@ -327,17 +327,25 @@ internal_getgrent_r (ent_t *ent, char *buffer, size_t buflen, const char *user, do { + /* We need at least 3 characters for one line. */ + if (__builtin_expect (buflen < 3, 0)) + { + erange: + *errnop = ERANGE; + return NSS_STATUS_TRYAGAIN; + } + fgetpos (ent->stream, &pos); buffer[buflen - 1] = '\xff'; p = fgets_unlocked (buffer, buflen, ent->stream); if (p == NULL && feof_unlocked (ent->stream)) return NSS_STATUS_NOTFOUND; - if (p == NULL || buffer[buflen - 1] != '\xff') + if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0)) { + erange_reset: fsetpos (ent->stream, &pos); - *errnop = ERANGE; - return NSS_STATUS_TRYAGAIN; + goto erange; } /* Terminate the line for any case. */ @@ -353,13 +361,9 @@ internal_getgrent_r (ent_t *ent, char *buffer, size_t buflen, const char *user, !(parse_res = _nss_files_parse_grent (p, &grpbuf, data, buflen, errnop))); - if (parse_res == -1) - { - /* The parser ran out of space. */ - fsetpos (ent->stream, &pos); - *errnop = ERANGE; - return NSS_STATUS_TRYAGAIN; - } + if (__builtin_expect (parse_res == -1, 0)) + /* The parser ran out of space. */ + goto erange_reset; if (grpbuf.gr_name[0] != '+' && grpbuf.gr_name[0] != '-') /* This is a real entry. */ |