svn commit: r365910 - head/lib/libc/gen

[Alan Somers]

Author: asomers
Date: Sat Sep 19 19:08:27 2020
New Revision: 365910
URL: https://svnweb.freebsd.org/changeset/base/365910

Log:
  fix integer underflow in getgrnam_r and getpwnam_r
  
  Sometimes nscd(8) will return a 1-byte buffer for a nonexistent entry. This
  triggered an integer underflow in grp_unmarshal_func, causing getgrnam_r to
  return ERANGE instead of 0.
  
  Fix the user's buffer size check, and add a correct check for a too-small
  nscd buffer.
  
  PR:		248932
  Event:		September 2020 Bugathon
  Reviewed by:	markj
  MFC after:	2 weeks
  Sponsored by:	Axcient
  Differential Revision: https://reviews.freebsd.org/D26204

Modified:
  head/lib/libc/gen/getgrent.c
  head/lib/libc/gen/getpwent.c

Modified: head/lib/libc/gen/getgrent.c
==============================================================================
--- head/lib/libc/gen/getgrent.c	Sat Sep 19 18:25:52 2020	(r365909)
+++ head/lib/libc/gen/getgrent.c	Sat Sep 19 19:08:27 2020	(r365910)
@@ -334,14 +334,27 @@ grp_unmarshal_func(char *buffer, size_t buffer_size, v
 	orig_buf_size = va_arg(ap, size_t);
 	ret_errno = va_arg(ap, int *);
 
-	if (orig_buf_size <
-	    buffer_size - sizeof(struct group) - sizeof(char *)) {
+	if (orig_buf_size + sizeof(struct group) + sizeof(char *) < buffer_size)
+	{
 		*ret_errno = ERANGE;
 		return (NS_RETURN);
+	} else if (buffer_size < sizeof(struct group) + sizeof(char *)) {
+		/*
+		 * nscd(8) sometimes returns buffer_size=1 for nonexistent
+		 * entries.
+		 */
+		*ret_errno = 0;
+		return (NS_NOTFOUND);
 	}
 
 	memcpy(grp, buffer, sizeof(struct group));
 	memcpy(&p, buffer + sizeof(struct group), sizeof(char *));
+
+	if (orig_buf_size + sizeof(struct group) + sizeof(char *) +
+	    _ALIGN(p) - (size_t)p < buffer_size) {
+		*ret_errno = ERANGE;
+		return (NS_RETURN);
+	}
 
 	orig_buf = (char *)_ALIGN(orig_buf);
 	memcpy(orig_buf, buffer + sizeof(struct group) + sizeof(char *) +

Modified: head/lib/libc/gen/getpwent.c
==============================================================================
--- head/lib/libc/gen/getpwent.c	Sat Sep 19 18:25:52 2020	(r365909)
+++ head/lib/libc/gen/getpwent.c	Sat Sep 19 19:08:27 2020	(r365910)
@@ -389,10 +389,17 @@ pwd_unmarshal_func(char *buffer, size_t buffer_size, v
 	orig_buf_size = va_arg(ap, size_t);
 	ret_errno = va_arg(ap, int *);
 
-	if (orig_buf_size <
-	    buffer_size - sizeof(struct passwd) - sizeof(char *)) {
+	if (orig_buf_size + sizeof(struct passwd) + sizeof(char *) <
+	    buffer_size) {
 		*ret_errno = ERANGE;
 		return (NS_RETURN);
+	} else if (buffer_size < sizeof(struct passwd) + sizeof(char *)) {
+		/*
+		 * nscd(8) sometimes returns buffer_size=1 for nonexistent
+		 * entries.
+		 */
+		*ret_errno = 0;
+		return (NS_NOTFOUND);
 	}
 
 	memcpy(pwd, buffer, sizeof(struct passwd));