* shadow/sgetspent_r.c (__sgetspent_r): Recognize too small buffers.

diff --git a/ChangeLog b/ChangeLog
index b961433ba0315950bb41505927d508ac0bccf5cd..f510a30f1bbd1e27130d246fb22d6b028fe91242 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 2009-04-23  Ulrich Drepper  <drepper@redhat.com>
 
+       * shadow/sgetspent_r.c (__sgetspent_r): Recognize too small buffers.
+
        * shadow/Makefile (tests): Add tst-shadow.
        * shadow/tst-shadow.c: New file.
 

diff --git a/NEWS b/NEWS
index d7e52f89828d971d844cac6ddae881a79bb8989e..411c2c3bc824310bade5eb16bb81b7ad98815ee6 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,4 @@
-GNU C Library NEWS -- history of user-visible changes.  2009-4-13
+GNU C Library NEWS -- history of user-visible changes.  2009-4-23
 Copyright (C) 1992-2008, 2009 Free Software Foundation, Inc.
 See the end for copying conditions.
 
@@ -44,6 +44,9 @@ Version 2.10
   and extend existing format specifiers.
   Implemented by Ulrich Drepper.
 
+* Handling for group shadow files has been added.
+  Implemented by Ulrich Drepper.
+
 \f
 Version 2.9
 

diff --git a/shadow/sgetspent_r.c b/shadow/sgetspent_r.c
index 2ed350a1ad62781b3ee053cdc701a611b3f5c1ba..5599ee4ec81211d4bdc99b34a87a9c8a4053a9a5 100644 (file)
--- a/shadow/sgetspent_r.c
+++ b/shadow/sgetspent_r.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996, 1997, 1998, 2005 Free Software Foundation, Inc.
+/* Copyright (C) 1996, 1997, 1998, 2005, 2009 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -91,8 +91,12 @@ int
 __sgetspent_r (const char *string, struct spwd *resbuf, char *buffer,
               size_t buflen, struct spwd **result)
 {
-  int parse_result = parse_line (strncpy (buffer, string, buflen),
-                                resbuf, NULL, 0, &errno);
+  buffer[buflen - 1] = '\0';
+  char *sp = strncpy (buffer, string, buflen);
+  if (buffer[buflen - 1] != '\0')
+    return ERANGE;
+
+  int parse_result = parse_line (sp, resbuf, NULL, 0, &errno);
   *result = parse_result > 0 ? resbuf : NULL;
 
   return *result == NULL ? errno : 0;