public inbox for glibc-bugs@sourceware.org help / color / mirror / Atom feed
From: "jgeisler at cse dot taylor dot edu" <sourceware-bugzilla@sourceware.org> To: glibc-bugs@sources.redhat.com Subject: [Bug libc/11397] New: calls to cuserid() can result in buffer overflows Date: Thu, 18 Mar 2010 03:25:00 -0000 [thread overview] Message-ID: <20100318032449.11397.jgeisler@cse.taylor.edu> (raw) Since cuserid() uses __getpwuid_r() to obtain the user name and then strncpy() to copy the user name to the final buffer, the buffer could end up with a non-NUL terminated value if the login name length >= L_cuserid. This seems wrong since L_cuserid is defined as 9 (8 default characters + 1 NUL) for the old setting when all usernames never exceeded 8 characters. It seems to me that since strncpy() is being used, we don't worry about maintaining the final result when it is too long to fit in a buffer of L_cuserid characters. Therefore, we should be safe and free to cut off one additional character to ensure the buffer truly is NUL-terminated. As far as I can determine, this bug has existed in glibc for an extremely long time since this interface is deprecated and probably not actively examined for this kind of issue. I only found it due to a legacy app that was crashing on me when I was logged in with long usernames, but not short usernames. My suggested patch for sysdeps/posix/cuserid.c is as follows: --- cuserid.c 2001-12-14 02:00:48.000000000 -0500 +++ cuserid.c.new 2010-03-17 23:08:38.000000000 -0400 @@ -44,5 +44,6 @@ if (s == NULL) s = name; - return strncpy (s, pwptr->pw_name, L_cuserid); + s[L_cuserid - 1] = '\0'; + return strncpy (s, pwptr->pw_name, L_cuserid - 1); } -- Summary: calls to cuserid() can result in buffer overflows Product: glibc Version: unspecified Status: NEW Severity: critical Priority: P2 Component: libc AssignedTo: drepper at redhat dot com ReportedBy: jgeisler at cse dot taylor dot edu CC: glibc-bugs at sources dot redhat dot com,jgeisler at cse dot taylor dot edu http://sourceware.org/bugzilla/show_bug.cgi?id=11397 ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
next reply other threads:[~2010-03-18 3:25 UTC|newest] Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top 2010-03-18 3:25 jgeisler at cse dot taylor dot edu [this message] 2010-03-18 12:14 ` [Bug libc/11397] calls to cuserid() can result in buffer overruns and/or overflows jgeisler at cse dot taylor dot edu 2010-03-18 13:21 ` ldv at altlinux dot org 2010-03-18 15:55 ` jgeisler at cse dot taylor dot edu 2010-03-24 23:03 ` drepper at redhat dot com
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20100318032449.11397.jgeisler@cse.taylor.edu \ --to=sourceware-bugzilla@sourceware.org \ --cc=glibc-bugs@sources.redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).