Fix endless loop with invalid /etc/shells file.

(cherry picked from commit caa6e77293d85e31dfde371b78862e9330a1478e)

diff --git a/ChangeLog b/ChangeLog
index 47f2e529d532478ea1aa00c1fdd62597262d6faf..b9f7357132f5c35f0c09ed83fa44a4ee8e76bc09 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-02-03  Ulrich Drepper  <drepper@redhat.com>
+
+       [BZ #11242]
+       * misc/getusershell.c (initshells): Allocate one more byte in input
+       buffer so that fgets doesn't loop undefinitely.
+
 2010-01-25  Andreas Schwab  <schwab@redhat.com>
 
        * iconv/iconv_prog.c (write_output): Fix check for open failure.

diff --git a/misc/getusershell.c b/misc/getusershell.c
index 636da322f961fd127910845adb47842f9bf0a3ec..0e4f79619f841484d1f947990cc538a927dca98d 100644 (file)
--- a/misc/getusershell.c
+++ b/misc/getusershell.c
@@ -116,7 +116,8 @@ initshells()
        }
        if (statb.st_size > ~(size_t)0 / sizeof (char *) * 3)
                goto init_okshells;
-       if ((strings = malloc(statb.st_size + 2)) == NULL)
+       flen = statb.st_size + 3;
+       if ((strings = malloc(flen)) == NULL)
                goto init_okshells;
        shells = malloc(statb.st_size / 3 * sizeof (char *));
        if (shells == NULL) {
@@ -126,7 +127,6 @@ initshells()
        }
        sp = shells;
        cp = strings;
-       flen = statb.st_size + 2;
        while (fgets_unlocked(cp, flen - (cp - strings), fp) != NULL) {
                while (*cp != '#' && *cp != '/' && *cp != '\0')
                        cp++;