Fix handling of netgroup cache in nscd

diff --git a/ChangeLog b/ChangeLog
index 6444a89034fa626ff1bc36a54b13eb2868b48c63..0afbce712c78f7e445b51dceabfe2445e43fb40e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2013-06-11  Andreas Schwab  <schwab@suse.de>
+
+       [BZ #15577]
+       * nscd/connections.c (nscd_run_worker): Always zero-terminate key.
+       * nscd/netgroupcache.c (addgetnetgrentX): Properly handle absent
+       values in the triple.
+       * nscd/nscd_netgroup.c (__nscd_setnetgrent): Include zero
+       terminator in the group key.
+
 2013-06-11  Andreas Jaeger  <aj@suse.de>
 
        * po/zh_TW.po: Update Chinese (traditional) translation from

diff --git a/NEWS b/NEWS
index 99c0c9491d822e5a0e7f6297ee8f8daca8733bc9..fe8d5b392693d70da00da434ae1dd53fa22a48d3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -19,7 +19,7 @@ Version 2.18
   15336, 15337, 15339, 15342, 15346, 15359, 15361, 15366, 15380, 15381,
   15394, 15395, 15405, 15406, 15409, 15416, 15418, 15419, 15423, 15424,
   15426, 15429, 15441, 15442, 15448, 15465, 15480, 15485, 15488, 15490,
-  15493, 15497, 15506, 15529, 15536, 15553, 15583.
+  15493, 15497, 15506, 15529, 15536, 15553, 15577, 15583.
 
 * CVE-2013-0242 Buffer overrun in regexp matcher has been fixed (Bugzilla
   #15078).

diff --git a/nscd/connections.c b/nscd/connections.c
index 7099215916df28da390ffa35f60262ab3d11fc6f..69e3e7dc08918a9db8cabfee221a510f62bcf107 100644 (file)
--- a/nscd/connections.c
+++ b/nscd/connections.c
@@ -1779,7 +1779,7 @@ nscd_run_worker (void *p)
       else
        {
          /* Get the key.  */
-         char keybuf[MAXKEYLEN];
+         char keybuf[MAXKEYLEN + 1];
 
          if (__builtin_expect (TEMP_FAILURE_RETRY (read (fd, keybuf,
                                                          req.key_len))
@@ -1791,6 +1791,7 @@ nscd_run_worker (void *p)
                         strerror_r (errno, buf, sizeof (buf)));
              goto close_and_out;
            }
+         keybuf[req.key_len] = '\0';
 
          if (__builtin_expect (debug_level, 0) > 0)
            {

diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
index 2d6c5aa4590aed274b5e69f1ca4f6c5548568756..dd06ce4faedf8824b4ee33037545858c4bfb8074 100644 (file)
--- a/nscd/netgroupcache.c
+++ b/nscd/netgroupcache.c
@@ -192,18 +192,26 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
                            const char *nuser = data.val.triple.user;
                            const char *ndomain = data.val.triple.domain;
 
-                           if (data.val.triple.host > data.val.triple.user
-                               || data.val.triple.user > data.val.triple.domain)
+                           if (nhost == NULL || nuser == NULL || ndomain == NULL
+                               || nhost > nuser || nuser > ndomain)
                              {
-                               const char *last = MAX (nhost,
-                                                       MAX (nuser, ndomain));
-                               size_t bufused = (last + strlen (last) + 1
-                                                 - buffer);
+                               const char *last = nhost;
+                               if (last == NULL
+                                   || (nuser != NULL && nuser > last))
+                                 last = nuser;
+                               if (last == NULL
+                                   || (ndomain != NULL && ndomain > last))
+                                 last = ndomain;
+
+                               size_t bufused
+                                 = (last == NULL
+                                    ? buffilled
+                                    : last + strlen (last) + 1 - buffer);
 
                                /* We have to make temporary copies.  */
-                               size_t hostlen = strlen (nhost) + 1;
-                               size_t userlen = strlen (nuser) + 1;
-                               size_t domainlen = strlen (ndomain) + 1;
+                               size_t hostlen = strlen (nhost ?: "") + 1;
+                               size_t userlen = strlen (nuser ?: "") + 1;
+                               size_t domainlen = strlen (ndomain ?: "") + 1;
                                size_t needed = hostlen + userlen + domainlen;
 
                                if (buflen - req->key_len - bufused < needed)
@@ -226,11 +234,11 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
                                  }
 
                                nhost = memcpy (buffer + bufused,
-                                               nhost, hostlen);
+                                               nhost ?: "", hostlen);
                                nuser = memcpy ((char *) nhost + hostlen,
-                                               nuser, userlen);
+                                               nuser ?: "", userlen);
                                ndomain = memcpy ((char *) nuser + userlen,
-                                                 ndomain, domainlen);
+                                                 ndomain ?: "", domainlen);
                              }
 
                            char *wp = buffer + buffilled;

diff --git a/nscd/nscd_netgroup.c b/nscd/nscd_netgroup.c
index cac4ebfcd32a89cda16a6e65a8313442da51e302..acb2c81457927e3d2d59037b29b3f7998f585f12 100644 (file)
--- a/nscd/nscd_netgroup.c
+++ b/nscd/nscd_netgroup.c
@@ -48,7 +48,7 @@ __nscd_setnetgrent (const char *group, struct __netgrent *datap)
 {
   int gc_cycle;
   int nretries = 0;
-  size_t group_len = strlen (group);
+  size_t group_len = strlen (group) + 1;
 
   /* If the mapping is available, try to search there instead of
      communicating with the nscd.  */