Fix cast-after-dereference

Original code was dereferencing a char*, then casting the value
to size_t.  Should cast the pointer to size_t* then deference.

(cherry picked from commit f8cef4d07d9641e27629bd3ce2d13f5d702fb251)

diff --git a/ChangeLog b/ChangeLog
index fe5103f03e6b6316cb5c60557033259e0875e799..80cb667dd2c21acef4c3b3c6265882eee03b013e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2017-07-19  DJ Delorie  <dj@delorie.com>
+
+       [BZ #21654]
+       * grp/grp-merge.c (libc_hidden_def): Fix cast-after-dereference.
+
 2017-07-14  DJ Delorie  <dj@redhat.com>
 
        [BZ #21654]

diff --git a/NEWS b/NEWS
index f60077bee57ccda4bec24b7672ea24c1370cc92b..f03910105af2a06a6b5ca1049910207ac1d938a8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,7 @@ The following bugs are resolved with this release:
   [21386] Assertion in fork for distinct parent PID is incorrect
   [21609] x86-64: Align the stack in __tls_get_addr
   [21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366)
+  [21654] nss: Fix invalid cast in group merging
 \f
 Version 2.24
 

diff --git a/grp/grp-merge.c b/grp/grp-merge.c
index 50573b898627f55652831eb4602ab468c9323868..5f79755798b2c0c34b286529636ad7a265913d02 100644 (file)
--- a/grp/grp-merge.c
+++ b/grp/grp-merge.c
@@ -137,7 +137,7 @@ __merge_grp (struct group *savedgrp, char *savedbuf, char *savedend,
 
   /* Get the count of group members from the last sizeof (size_t) bytes in the
      mergegrp buffer.  */
-  savedmemcount = (size_t) *(savedend - sizeof (size_t));
+  savedmemcount = *(size_t *) (savedend - sizeof (size_t));
 
   /* Get the count of new members to add.  */
   for (memcount = 0; mergegrp->gr_mem[memcount]; memcount++)