Reproducer (needs to run as root):
perl -e \
'print "large:x:999:" . join(",", map {"user$_"} (1 .. 135))."\n"' \
>> /etc/group
cd /var/db
make
getent -s db group
After the fix, the last command should list the "large" group.
The magic number 135 has been chosen so that the line is shorter than
1024 bytes, but the pointers required to encode the member array will
cross the threshold, triggering the bug.
(cherry picked from commit
a6033052d08027f745867e5e346852da1959226c)
(cherry picked from commit
28a87e027450b66faf1a431fc62779297c760e29)
}
if (err < 0)
{
- H_ERRNO_SET (HOST_NOT_FOUND);
- status = NSS_STATUS_NOTFOUND;
+ H_ERRNO_SET (NETDB_INTERNAL);
+ status = NSS_STATUS_TRYAGAIN;
break;
}