Page MenuHomeFreeBSD
Files F108016262

D26204.diff
No OneTemporary
Actions

D26204.diff
View Options

Index: head/lib/libc/gen/getgrent.c
===================================================================
--- head/lib/libc/gen/getgrent.c
+++ head/lib/libc/gen/getgrent.c
@@ -334,14 +334,27 @@
orig_buf_size = va_arg(ap, size_t);
ret_errno = va_arg(ap, int *);
- if (orig_buf_size <
- buffer_size - sizeof(struct group) - sizeof(char *)) {
+ if (orig_buf_size + sizeof(struct group) + sizeof(char *) < buffer_size)
+ {
*ret_errno = ERANGE;
return (NS_RETURN);
+ } else if (buffer_size < sizeof(struct group) + sizeof(char *)) {
+ /*
+ * nscd(8) sometimes returns buffer_size=1 for nonexistent
+ * entries.
+ */
+ *ret_errno = 0;
+ return (NS_NOTFOUND);
}
memcpy(grp, buffer, sizeof(struct group));
memcpy(&p, buffer + sizeof(struct group), sizeof(char *));
+
+ if (orig_buf_size + sizeof(struct group) + sizeof(char *) +
+ _ALIGN(p) - (size_t)p < buffer_size) {
+ *ret_errno = ERANGE;
+ return (NS_RETURN);
+ }
orig_buf = (char *)_ALIGN(orig_buf);
memcpy(orig_buf, buffer + sizeof(struct group) + sizeof(char *) +
Index: head/lib/libc/gen/getpwent.c
===================================================================
--- head/lib/libc/gen/getpwent.c
+++ head/lib/libc/gen/getpwent.c
@@ -389,10 +389,17 @@
orig_buf_size = va_arg(ap, size_t);
ret_errno = va_arg(ap, int *);
- if (orig_buf_size <
- buffer_size - sizeof(struct passwd) - sizeof(char *)) {
+ if (orig_buf_size + sizeof(struct passwd) + sizeof(char *) <
+ buffer_size) {
*ret_errno = ERANGE;
return (NS_RETURN);
+ } else if (buffer_size < sizeof(struct passwd) + sizeof(char *)) {
+ /*
+ * nscd(8) sometimes returns buffer_size=1 for nonexistent
+ * entries.
+ */
+ *ret_errno = 0;
+ return (NS_NOTFOUND);
}
memcpy(pwd, buffer, sizeof(struct passwd));

File Metadata

Mime Type
text/plain
Expires
Tue, Jan 21, 1:46 PM (21 h, 37 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
16012237
Default Alt Text
D26204.diff (1 KB)

Event Timeline