From 676599b36a92f3c201c5682ee7a5caddd9f370a4 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Fri, 2 Oct 2015 11:34:13 +0200 Subject: Harden putpwent, putgrent, putspent, putspent against injection [BZ #18724] This prevents injection of ':' and '\n' into output functions which use the NSS files database syntax. Critical fields (user/group names and file system paths) are checked strictly. For backwards compatibility, the GECOS field is rewritten instead. The getent program is adjusted to use the put*ent functions in libc, instead of local copies. This changes the behavior of getent if user names start with '-' or '+'. --- nss/rewrite_field.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 nss/rewrite_field.c (limited to 'nss/rewrite_field.c') diff --git a/nss/rewrite_field.c b/nss/rewrite_field.c new file mode 100644 index 0000000000..fb9d274842 --- /dev/null +++ b/nss/rewrite_field.c @@ -0,0 +1,51 @@ +/* Copyright (C) 2015 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include + +/* Rewrite VALUE to a valid field value in the NSS database. Invalid + characters are replaced with a single space character ' '. If + VALUE is NULL, the empty string is returned. *TO_BE_FREED is + overwritten with a pointer the caller has to free if the function + returns successfully. On failure, return NULL. */ +const char * +__nss_rewrite_field (const char *value, char **to_be_freed) +{ + *to_be_freed = NULL; + if (value == NULL) + return ""; + + /* Search for non-allowed characters. */ + const char *p = strpbrk (value, __nss_invalid_field_characters); + if (p == NULL) + return value; + *to_be_freed = __strdup (value); + if (*to_be_freed == NULL) + return NULL; + + /* Switch pointer to freshly-allocated buffer. */ + char *bad = *to_be_freed + (p - value); + do + { + *bad = ' '; + bad = strpbrk (bad + 1, __nss_invalid_field_characters); + } + while (bad != NULL); + + return *to_be_freed; +} -- cgit 1.4.1