Page MenuHomeFreeBSD
Files F107982477

D26204.id77225.diff
No OneTemporary
Actions

D26204.id77225.diff
View Options

Index: lib/libc/gen/getgrent.c
===================================================================
--- lib/libc/gen/getgrent.c
+++ lib/libc/gen/getgrent.c
@@ -334,14 +334,28 @@
orig_buf_size = va_arg(ap, size_t);
ret_errno = va_arg(ap, int *);
- if (orig_buf_size <
- buffer_size - sizeof(struct group) - sizeof(char *)) {
+ if (orig_buf_size + sizeof(struct group) + sizeof(char *) < buffer_size)
+ {
*ret_errno = ERANGE;
return (NS_RETURN);
+ } else if (buffer_size < sizeof(struct group) + sizeof(char *)) {
+ /*
+ * nscd(8) sometimes returns buffer_size=1 for nonexistent
+ * entries.
+ */
+ *ret_errno = 0;
+ return (NS_UNAVAIL);
}
memcpy(grp, buffer, sizeof(struct group));
memcpy(&p, buffer + sizeof(struct group), sizeof(char *));
+
+ if (orig_buf_size + sizeof(struct group) + sizeof(char *) +
+ _ALIGN(p) - (size_t)p < buffer_size)
+ {
+ *ret_errno = ERANGE;
+ return (NS_RETURN);
+ }
orig_buf = (char *)_ALIGN(orig_buf);
memcpy(orig_buf, buffer + sizeof(struct group) + sizeof(char *) +
Index: lib/libc/gen/getpwent.c
===================================================================
--- lib/libc/gen/getpwent.c
+++ lib/libc/gen/getpwent.c
@@ -389,10 +389,19 @@
orig_buf_size = va_arg(ap, size_t);
ret_errno = va_arg(ap, int *);
- if (orig_buf_size <
- buffer_size - sizeof(struct passwd) - sizeof(char *)) {
+ if (orig_buf_size + sizeof(struct passwd) + sizeof(char *) <
+ buffer_size)
+ {
*ret_errno = ERANGE;
return (NS_RETURN);
+ } else if (buffer_size < sizeof(struct passwd) + sizeof(char *))
+ {
+ /*
+ * nscd(8) sometimes returns buffer_size=1 for nonexistent
+ * entries.
+ */
+ *ret_errno = 0;
+ return (NS_UNAVAIL);
}
memcpy(pwd, buffer, sizeof(struct passwd));

File Metadata

Mime Type
text/plain
Expires
Tue, Jan 21, 4:35 AM (14 h, 44 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
15999407
Default Alt Text
D26204.id77225.diff (1 KB)

Event Timeline