]> git.ipfire.org Git - thirdparty/shadow.git/commitdiff
Read whole line in yes_or_no
authorSamanta Navarro <ferivoz@riseup.net>
Fri, 27 Jan 2023 11:53:57 +0000 (11:53 +0000)
committerSerge Hallyn <serge@hallyn.com>
Fri, 21 Apr 2023 23:12:56 +0000 (18:12 -0500)
Do not stop after 79 characters. Read the complete line to avoid
arbitrary limitations.

Proof of Concept:

```
cat > passwd-poc << EOF
root:x:0:0:root:/root:/bin/bash
root:x:0:0:root:/root:/bin/bash
root:x:0:0:root:/root:/bin/bash
EOF
python -c "print(80*'y')" | pwck passwd-poc
```

Two lines should still be within the file because we agreed only once
to remove a duplicated line.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
Reviewed-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
libmisc/yesno.c

index 1a1a3714661ec1fc385e51b4343624f78d1151b2..d8847e40e377bfadbc312fe26c780cf967985a7f 100644 (file)
@@ -28,7 +28,8 @@
  */
 bool yes_or_no (bool read_only)
 {
-       char buf[80];
+       int c;
+       bool result;
 
        /*
         * In read-only mode all questions are answered "no".
@@ -46,11 +47,13 @@ bool yes_or_no (bool read_only)
        /*
         * Get a line and see what the first character is.
         */
+       c = fgetc(stdin);
        /* TODO: use gettext */
-       if (fgets (buf, sizeof buf, stdin) == buf) {
-               return buf[0] == 'y' || buf[0] == 'Y';
-       }
+       result = (c == 'y' || c == 'Y');
+
+       while (c != '\n' && c != EOF)
+               c = fgetc(stdin);
 
-       return false;
+       return result;
 }