From f75c298e747b2b8b41b1c2f551c011a52c41bfd1 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Thu, 25 Apr 2024 15:00:45 +0200 Subject: CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677) Using alloca matches what other caches do. The request length is bounded by MAXKEYLEN. Reviewed-by: Carlos O'Donell (cherry picked from commit 87801a8fd06db1d654eea3e4f7626ff476a9bdaa) --- nscd/netgroupcache.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c index 439dd4ba38..ef76a7e590 100644 --- a/nscd/netgroupcache.c +++ b/nscd/netgroupcache.c @@ -502,12 +502,13 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req, = (struct indataset *) mempool_alloc (db, sizeof (*dataset) + req->key_len, 1); - struct indataset dataset_mem; bool cacheable = true; if (__glibc_unlikely (dataset == NULL)) { cacheable = false; - dataset = &dataset_mem; + /* The alloca is safe because nscd_run_worker verfies that + key_len is not larger than MAXKEYLEN. */ + dataset = alloca (sizeof (*dataset) + req->key_len); } datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len, -- cgit 1.4.1