last: fix wtmp user name buffer overflow [asan]

Ensure utmp user name field is null terminated.  Without that getpwnam() can
buffer overflow, when wtmp file is malformed.

Addresses: https://github.com/karelzak/util-linux/issues/715
Signed-off-by: Sami Kerola <kerolasa@iki.fi>

diff --git a/login-utils/last.c b/login-utils/last.c
index 6b25efd4c6932cbc96080bb971e27121c1099329..be744b079198ecf11ba05eed990c5f942bca18c0 100644 (file)
--- a/login-utils/last.c
+++ b/login-utils/last.c
@@ -600,6 +600,7 @@ static int is_phantom(const struct last_control *ctl, struct utmpx *ut)
 
        if (ut->ut_tv.tv_sec < ctl->boot_time.tv_sec)
                return 1;
+       ut->ut_user[__UT_NAMESIZE - 1] = '\0';
        pw = getpwnam(ut->ut_user);
        if (!pw)
                return 1;