From: Ulrich Drepper <drepper@redhat.com>
Date: Wed, 3 Feb 2010 14:23:31 +0000 (-0800)
Subject: Fix endless loop with invalid /etc/shells file.
X-Git-Tag: fedora/glibc-2.11.90-12~3^2~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=caa6e77293d85e31dfde371b78862e9330a1478e;p=thirdparty%2Fglibc.git

Fix endless loop with invalid /etc/shells file.
---

diff --git a/ChangeLog b/ChangeLog
index e8aad253e1c..f895a8ca28a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-02-03  Ulrich Drepper  <drepper@redhat.com>
+
+	[BZ #11242]
+	* misc/getusershell.c (initshells): Allocate one more byte in input
+	buffer so that fgets doesn't loop undefinitely.
+
 2010-02-02  Ulrich Drepper  <drepper@redhat.com>
 
 	* stdlib/setenv.c (__add_to_environ): Don't use alloca if
diff --git a/misc/getusershell.c b/misc/getusershell.c
index 636da322f96..0e4f79619f8 100644
--- a/misc/getusershell.c
+++ b/misc/getusershell.c
@@ -116,7 +116,8 @@ initshells()
 	}
 	if (statb.st_size > ~(size_t)0 / sizeof (char *) * 3)
 		goto init_okshells;
-	if ((strings = malloc(statb.st_size + 2)) == NULL)
+	flen = statb.st_size + 3;
+	if ((strings = malloc(flen)) == NULL)
 		goto init_okshells;
 	shells = malloc(statb.st_size / 3 * sizeof (char *));
 	if (shells == NULL) {
@@ -126,7 +127,6 @@ initshells()
 	}
 	sp = shells;
 	cp = strings;
-	flen = statb.st_size + 2;
 	while (fgets_unlocked(cp, flen - (cp - strings), fp) != NULL) {
 		while (*cp != '#' && *cp != '/' && *cp != '\0')
 			cp++;