Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* parse uid with strtoul() instead of atoi(), and sanity check a) the parsed

Browse Source 
value was just a number, b) it doesn't exceed UID_MAX
* convert uid to a string with %u not %d
This commit is contained in:
lukem 1997-05-22 03:14:42 +00:00
parent ad8e075042
commit f442f20a30
1 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
lib/libc/gen/getpwent.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: getpwent.c,v 1.18 1997/05/21 01:51:40 lukem Exp $ */ /* $NetBSD: getpwent.c,v 1.19 1997/05/22 03:14:42 lukem Exp $ */
/* /*
* Copyright (c) 1988, 1993 * Copyright (c) 1988, 1993
@ -38,7 +38,7 @@
#if 0 #if 0
static char sccsid[] = "@(#)getpwent.c 8.1 (Berkeley) 6/4/93"; static char sccsid[] = "@(#)getpwent.c 8.1 (Berkeley) 6/4/93";
#else #else
static char rcsid[] = "$NetBSD: getpwent.c,v 1.18 1997/05/21 01:51:40 lukem Exp $"; static char rcsid[] = "$NetBSD: getpwent.c,v 1.19 1997/05/22 03:14:42 lukem Exp $";
#endif #endif
#endif /* LIBC_SCCS and not lint */ #endif /* LIBC_SCCS and not lint */
@ -218,7 +218,8 @@ __ypparse(pw, s)
struct passwd *pw; struct passwd *pw;
char *s; char *s;
{ {
char *bp, *cp; char *bp, *cp, *ep;
unsigned long id;
/* since this is currently using strsep(), parse it first */ /* since this is currently using strsep(), parse it first */
bp = s; bp = s;
@ -226,10 +227,16 @@ char *s;
pw->pw_passwd = strsep(&bp, ":\n"); pw->pw_passwd = strsep(&bp, ":\n");
if (!(cp = strsep(&bp, ":\n"))) if (!(cp = strsep(&bp, ":\n")))
return 1; return 1;
pw->pw_uid = atoi(cp); id = strtoul(cp, &ep, 10);
if (id > UID_MAX || *ep == '\0')
return 1;
pw->pw_uid = (uid_t)id;
if (!(cp = strsep(&bp, ":\n"))) if (!(cp = strsep(&bp, ":\n")))
return 1; return 1;
pw->pw_gid = atoi(cp); id = strtoul(cp, &ep, 10);
if (id > GID_MAX || *ep == '\0')
return 1;
pw->pw_gid = (gid_t)id;
pw->pw_change = 0; pw->pw_change = 0;
pw->pw_class = ""; pw->pw_class = "";
pw->pw_gecos = strsep(&bp, ":\n"); pw->pw_gecos = strsep(&bp, ":\n");
@ -657,7 +664,8 @@ getpwuid(uid)
{ {
DBT key; DBT key;
char bf[sizeof(_pw_keynum) + 1]; char bf[sizeof(_pw_keynum) + 1];
int keyuid, rval; uid_t keyuid;
int rval;
if (!_pw_db && !__initdb()) if (!_pw_db && !__initdb())
return((struct passwd *)NULL); return((struct passwd *)NULL);
@ -673,7 +681,7 @@ getpwuid(uid)
int s = -1; int s = -1;
const char *host, *user, *dom; const char *host, *user, *dom;
snprintf(uidbuf, sizeof uidbuf, "%d", uid); snprintf(uidbuf, sizeof(uidbuf), "%u", uid);
for(_pw_keynum=1; _pw_keynum; _pw_keynum++) { for(_pw_keynum=1; _pw_keynum; _pw_keynum++) {
bf[0] = _PW_KEYBYNUM; bf[0] = _PW_KEYBYNUM;
bcopy((char *)&_pw_keynum, bf + 1, sizeof(_pw_keynum)); bcopy((char *)&_pw_keynum, bf + 1, sizeof(_pw_keynum));