summaryrefslogtreecommitdiffstats
path: root/lib/libc/gen
diff options
context:
space:
mode:
authormaxim <maxim@FreeBSD.org>2002-09-25 08:49:19 +0000
committermaxim <maxim@FreeBSD.org>2002-09-25 08:49:19 +0000
commitf58719dbdb8649dd3a29aeaadbd11fcb5b7d196d (patch)
treee4e5db8e3de7ade92ca26129f6f20f2168777c54 /lib/libc/gen
parent1407fc5c4e85c23752a75e28c0abc44b737fe5c6 (diff)
downloadFreeBSD-src-f58719dbdb8649dd3a29aeaadbd11fcb5b7d196d.zip
FreeBSD-src-f58719dbdb8649dd3a29aeaadbd11fcb5b7d196d.tar.gz
Disqualify UID/GID with non-numeric character.
PR: bin/41721 Reviewed by: tjr, silence on -audit MFC after: 2 weeks
Diffstat (limited to 'lib/libc/gen')
-rw-r--r--lib/libc/gen/pw_scan.c16
1 files changed, 13 insertions, 3 deletions
diff --git a/lib/libc/gen/pw_scan.c b/lib/libc/gen/pw_scan.c
index efe6566..95328a8 100644
--- a/lib/libc/gen/pw_scan.c
+++ b/lib/libc/gen/pw_scan.c
@@ -70,7 +70,7 @@ __pw_scan(char *bp, struct passwd *pw, int flags)
{
uid_t id;
int root;
- char *p, *sh;
+ char *ep, *p, *sh;
if (pw_big_ids_warning == -1)
pw_big_ids_warning = getenv("PW_SCAN_BIG_IDS") == NULL ? 1 : 0;
@@ -98,12 +98,17 @@ __pw_scan(char *bp, struct passwd *pw, int flags)
return (0);
}
}
- id = strtoul(p, (char **)NULL, 10);
+ id = strtoul(p, &ep, 10);
if (errno == ERANGE) {
if (flags & _PWSCAN_WARN)
warnx("%s > max uid value (%lu)", p, ULONG_MAX);
return (0);
}
+ if (*ep != '\0' || ep == p) {
+ if (flags & _PWSCAN_WARN)
+ warnx("%s uid is incorrect", p);
+ return (0);
+ }
if (root && id) {
if (flags & _PWSCAN_WARN)
warnx("root uid should be 0");
@@ -119,12 +124,17 @@ __pw_scan(char *bp, struct passwd *pw, int flags)
goto fmt;
if (p[0])
pw->pw_fields |= _PWF_GID;
- id = strtoul(p, (char **)NULL, 10);
+ id = strtoul(p, &ep, 10);
if (errno == ERANGE) {
if (flags & _PWSCAN_WARN)
warnx("%s > max gid value (%lu)", p, ULONG_MAX);
return (0);
}
+ if (*ep != '\0' || ep == p) {
+ if (flags & _PWSCAN_WARN)
+ warnx("%s gid is incorrect", p);
+ return (0);
+ }
if (flags & _PWSCAN_WARN && pw_big_ids_warning && id > USHRT_MAX) {
warnx("%s > recommended max gid value (%u)", p, USHRT_MAX);
/* return (0); This should not be fatal! */
OpenPOWER on IntegriCloud