From: Serge Hallyn Date: Sun, 19 Jul 2026 13:30:11 +0000 (-0500) Subject: find_range: avoid count==0 bug X-Git-Tag: 4.20.0-rc3~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9463d57b01a2aee4915de0c7cd96815342a000b1;p=thirdparty%2Fshadow.git find_range: avoid count==0 bug If someone has a subuid range with count==0, the variable last is calculated as first + count - 1, meaning last == first - 1. Since the calculated range wraps around, this can invalidate later checks. Check for this case explicitly. Because of other checks, this can only lead to erroneous ranges being created if the first loweruid is 0. This means that the subid range has to be user:0:0, which is doubly wrong, and should never be seen in the real world. A note on formatting: the calculations of first and last are done in their declarations. If range->count == 0, these go unused. The alternatives would be to declare the variables later in the scope - which we do not do - or to assign them later, adding 3 more lines in each scope. Since this case (again) should never happen, it's not worth avoiding the extra assignments in this error case. Signed-off-by: Serge Hallyn Reported-by: Mohammad Hossein Abedini --- diff --git a/lib/subordinateio.c b/lib/subordinateio.c index 97994168a..8542d7932 100644 --- a/lib/subordinateio.c +++ b/lib/subordinateio.c @@ -222,6 +222,9 @@ static const struct subordinate_range *find_range(struct commonio_db *db, unsigned long first = range->start; unsigned long last = first + range->count - 1; + if (range->count == 0) + continue; + if (!streq(range->owner, owner)) continue; @@ -249,6 +252,9 @@ static const struct subordinate_range *find_range(struct commonio_db *db, unsigned long first = range->start; unsigned long last = first + range->count - 1; + if (range->count == 0) + continue; + /* For performance reasons check range before using getpwnam() */ if ((val < first) || (val > last)) { continue;