From 2dfdc6d690dc53429e57aff74d9a76f94e4a6cc4 Mon Sep 17 00:00:00 2001 From: Andrew Borodin Date: Fri, 28 May 2021 10:40:18 +0300 Subject: [PATCH] (vfs_finduid): fix overrunning string. Fix out-of-boundary access to uname if it's shorter than 255 bytes. Found by Coverity. Coverity id #331835. Signed-off-by: Andrew Borodin --- lib/vfs/utilvfs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/vfs/utilvfs.c b/lib/vfs/utilvfs.c index 5ae54867e..a86253f0c 100644 --- a/lib/vfs/utilvfs.c +++ b/lib/vfs/utilvfs.c @@ -108,8 +108,12 @@ vfs_finduid (const char *uname) static int saveuid = GUID_DEFAULT_CONST; static char saveuname[TUNMLEN] = "\0"; + size_t uname_len; + + uname_len = strlen (uname); + if (uname[0] != saveuname[0] /* Quick test w/o proc call */ - || 0 != strncmp (uname, saveuname, TUNMLEN)) + || strncmp (uname, saveuname, MIN (uname_len, TUNMLEN - 1)) != 0) { struct passwd *pw;