projects/aports·blob master · refs

144 lines · 4.2 KiB

1--- a/support/nfsidmap/libnfsidmap.c
2+++ b/support/nfsidmap/libnfsidmap.c
3@@ -432,11 +432,17 @@ int nfs4_init_name_mapping(char *conffil
4
5 nobody_user = conf_get_str("Mapping", "Nobody-User");
6 if (nobody_user) {
7- size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
8+ long scbuflen = sysconf(_SC_GETPW_R_SIZE_MAX);
9+ size_t buflen = 1024; /*value on my gentoo glibc system that has _SC_GETPW_R_SIZE_MAX*/
10 struct passwd *buf;
11 struct passwd *pw = NULL;
12 int err;
13
14+ /*sysconf can return -1 when _SC_GETPW_R_SIZE_MAX is not defined, like on musl systems, if cast to size_t this will lead
15+ to an integer overflow, which leads to a buffer overflow and crashes svcgssd */
16+ if (scbuflen > 0)
17+ buflen = (size_t)scbuflen;
18+
19 buf = malloc(sizeof(*buf) + buflen);
20 if (buf) {
21 err = getpwnam_r(nobody_user, buf, ((char *)buf) + sizeof(*buf), buflen, &pw);
22@@ -453,11 +459,17 @@ int nfs4_init_name_mapping(char *conffil
23
24 nobody_group = conf_get_str("Mapping", "Nobody-Group");
25 if (nobody_group) {
26- size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
27+ long scbuflen = sysconf(_SC_GETGR_R_SIZE_MAX);
28+ size_t buflen = 1024; /*value on my gentoo glibc system that has _SC_GETGR_R_SIZE_MAX*/
29 struct group *buf;
30 struct group *gr = NULL;
31 int err;
32
33+ /*sysconf can return -1 when _SC_GETGR_R_SIZE_MAX is not defined, like on musl systems, if cast to size_t this will lead
34+ to an integer overflow, which leads to a buffer overflow and crashes svcgssd */
35+ if (scbuflen > 0)
36+ buflen = (size_t)scbuflen;
37+
38 buf = malloc(sizeof(*buf) + buflen);
39 if (buf) {
40 err = getgrnam_r(nobody_group, buf, ((char *)buf) + sizeof(*buf), buflen, &gr);
41--- a/support/nfsidmap/static.c
42+++ b/support/nfsidmap/static.c
43@@ -98,10 +98,14 @@ static struct passwd *static_getpwnam(co
44 {
45 struct passwd *pw;
46 struct pwbuf *buf;
47- size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
48+ long scbuflen = sysconf(_SC_GETPW_R_SIZE_MAX);
49+ size_t buflen = 1024;
50 char *localname;
51 int err;
52
53+ if (scbuflen > 0)
54+ buflen = (size_t)scbuflen;
55+
56 buf = malloc(sizeof(*buf) + buflen);
57 if (!buf) {
58 err = ENOMEM;
59@@ -149,10 +153,14 @@ static struct group *static_getgrnam(con
60 {
61 struct group *gr;
62 struct grbuf *buf;
63- size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
64+ long scbuflen = sysconf(_SC_GETGR_R_SIZE_MAX);
65+ size_t buflen = 1024;
66 char *localgroup;
67 int err;
68
69+ if (scbuflen > 0)
70+ buflen = (size_t)scbuflen;
71+
72 buf = malloc(sizeof(*buf) + buflen);
73 if (!buf) {
74 err = ENOMEM;
75--- a/support/nfsidmap/nss.c
76+++ b/support/nfsidmap/nss.c
77@@ -91,9 +91,13 @@ static int nss_uid_to_name(uid_t uid, ch
78 struct passwd *pw = NULL;
79 struct passwd pwbuf;
80 char *buf;
81- size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
82+ long scbuflen = sysconf(_SC_GETPW_R_SIZE_MAX);
83+ size_t buflen = 1024;
84 int err = -ENOMEM;
85
86+ if (scbuflen > 0)
87+ buflen = (size_t)scbuflen;
88+
89 buf = malloc(buflen);
90 if (!buf)
91 goto out;
92@@ -119,9 +123,13 @@ static int nss_gid_to_name(gid_t gid, ch
93 struct group *gr = NULL;
94 struct group grbuf;
95 char *buf;
96- size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
97+ long scbuflen = sysconf(_SC_GETGR_R_SIZE_MAX);
98+ size_t buflen = 1024;
99 int err;
100
101+ if (scbuflen > 0)
102+ buflen = (size_t)scbuflen;
103+
104 if (domain == NULL)
105 domain = get_default_domain();
106
107@@ -192,12 +200,13 @@ static struct passwd *nss_getpwnam(const
108 {
109 struct passwd *pw;
110 struct pwbuf *buf;
111- size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
112+ long scbuflen = sysconf(_SC_GETPW_R_SIZE_MAX);
113+ size_t buflen = 1024;
114 char *localname;
115 int err = ENOMEM;
116
117- if (buflen > UINT_MAX)
118- goto err;
119+ if (scbuflen > 0)
120+ buflen = (size_t)scbuflen;
121
122 buf = malloc(sizeof(*buf) + buflen);
123 if (buf == NULL)
124@@ -301,7 +310,8 @@ static int _nss_name_to_gid(char *name,
125 struct group *gr = NULL;
126 struct group grbuf;
127 char *buf, *domain;
128- size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
129+ long scbuflen = sysconf(_SC_GETGR_R_SIZE_MAX);
130+ size_t buflen = 1024;
131 int err = -EINVAL;
132 char *localname = NULL;
133 char *ref_name = NULL;
134@@ -327,8 +337,8 @@ static int _nss_name_to_gid(char *name,
135 }
136
137 err = -ENOMEM;
138- if (buflen > UINT_MAX)
139- goto out_name;
140+ if (scbuflen > 0)
141+ buflen = (size_t)scbuflen;
142
143 do {
144 buf = malloc(buflen);