[Bug nscd/31572] New: getnetgrent_r stores results outside buffer if nscd is running

["byrnes at deshaw dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=31572

            Bug ID: 31572
           Summary: getnetgrent_r stores results outside buffer if nscd is
                    running
           Product: glibc
           Version: 2.39
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: nscd
          Assignee: unassigned at sourceware dot org
          Reporter: byrnes at deshaw dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Created attachment 15442
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15442&action=edit
repro.c - reproducer for getnetgrent_r nscd bug

If nscd is running, getnetgrent_r stores (user, group, domain) strings outside
of the specified buffer.

This easy to reproduce:

Compile the attached program with gcc -DNETGROUP=\"valid-netgroup-name\" ...

Run on a system with nscd running and configured to enable netgroup caching,
and with glibc configured to use nscd.  Observe the assertion failures because
(user, group, domain) point to locations outside of the buffer.

I think this happens because nscd_getnetgrent doesn't use the buffer at all.

I can reproduce this on all glibc versions that I've tried between 2.28 and
2.38 - I believe it will also reproduce on the latest 2.39.

This is bad because the strings in the buffer are supposed to remain valid even
after other netgroup-related functions are called, but I suspect that's not
really true when the results are elsewhere.

-- 
You are receiving this mail because:
You are on the CC list for the bug.