This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug libc/11397] New: calls to cuserid() can result in buffer overflows
- From: "jgeisler at cse dot taylor dot edu" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sources dot redhat dot com
- Date: 18 Mar 2010 03:24:50 -0000
- Subject: [Bug libc/11397] New: calls to cuserid() can result in buffer overflows
- Reply-to: sourceware-bugzilla at sourceware dot org
Since cuserid() uses __getpwuid_r() to obtain the user name and then strncpy()
to copy the user name to the final buffer, the buffer could end up with a
non-NUL terminated value if the login name length >= L_cuserid. This seems
wrong since L_cuserid is defined as 9 (8 default characters + 1 NUL) for the old
setting when all usernames never exceeded 8 characters. It seems to me that
since strncpy() is being used, we don't worry about maintaining the final result
when it is too long to fit in a buffer of L_cuserid characters. Therefore, we
should be safe and free to cut off one additional character to ensure the buffer
truly is NUL-terminated.
As far as I can determine, this bug has existed in glibc for an extremely long
time since this interface is deprecated and probably not actively examined for
this kind of issue. I only found it due to a legacy app that was crashing on me
when I was logged in with long usernames, but not short usernames.
My suggested patch for sysdeps/posix/cuserid.c is as follows:
--- cuserid.c 2001-12-14 02:00:48.000000000 -0500
+++ cuserid.c.new 2010-03-17 23:08:38.000000000 -0400
@@ -44,5 +44,6 @@
if (s == NULL)
s = name;
- return strncpy (s, pwptr->pw_name, L_cuserid);
+ s[L_cuserid - 1] = '\0';
+ return strncpy (s, pwptr->pw_name, L_cuserid - 1);
}
--
Summary: calls to cuserid() can result in buffer overflows
Product: glibc
Version: unspecified
Status: NEW
Severity: critical
Priority: P2
Component: libc
AssignedTo: drepper at redhat dot com
ReportedBy: jgeisler at cse dot taylor dot edu
CC: glibc-bugs at sources dot redhat dot com,jgeisler at cse
dot taylor dot edu
http://sourceware.org/bugzilla/show_bug.cgi?id=11397
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.