Prevent out of boundary access

If lines start with '\0' then it is possible to trigger out of
boundary accesses.

Check if indices are valid before accessing them.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>

diff --git a/src/login_nopam.c b/src/login_nopam.c
index b09cffe4a6fe60d25026b31a45aef069b0cd455c..18072a43aa61b1858f8da5d0d5b28a15fc44084d 100644 (file)
--- a/src/login_nopam.c
+++ b/src/login_nopam.c
@@ -100,7 +100,7 @@ int login_access (const char *user, const char *from)
                        int end;
                        lineno++;
                        end = (int) strlen (line) - 1;
-                       if (line[end] != '\n') {
+                       if (line[0] == '\0' || line[end] != '\n') {
                                SYSLOG ((LOG_ERR,
                                         "%s: line %d: missing newline or line too long",
                                         TABLE, lineno));
@@ -320,7 +320,7 @@ static bool from_match (const char *tok, const char *string)
                if (strchr (string, '.') == NULL) {
                        return true;
                }
-       } else if (   (tok[(tok_len = strlen (tok)) - 1] == '.') /* network */
+       } else if (   (tok[0] != '\0' && tok[(tok_len = strlen (tok)) - 1] == '.') /* network */
                   && (strncmp (tok, resolve_hostname (string), tok_len) == 0)) {
                return true;
        }

diff --git a/src/suauth.c b/src/suauth.c
index 2641d334f262ddc1b561903600d94fa3c997ce42..d68a3340000d535a582e1f60a60420aa79af8586 100644 (file)
--- a/src/suauth.c
+++ b/src/suauth.c
@@ -68,8 +68,9 @@ int check_su_auth (const char *actual_id,
 
        while (fgets (temp, sizeof (temp), authfile_fd) != NULL) {
                lines++;
+               endline = strlen(temp) - 1;
 
-               if (temp[endline = strlen (temp) - 1] != '\n') {
+               if (temp[0] == '\0' || temp[endline] != '\n') {
                        SYSLOG ((LOG_ERR,
                                 "%s, line %d: line too long or missing newline",
                                 SUAUTHFILE, lines));