commit ea7d8b95e2fcb81f68b04ed7787a3dbda023991a

Author: Siddhesh Poyarekar <siddhesh@redhat.com>

Date:   Thu Mar 27 19:48:15 2014 +0530

    Avoid overlapping addresses to stpcpy calls in nscd (BZ #16760)

    Calls to stpcpy from nscd netgroups code will have overlapping source

    and destination when all three values in the returned triplet are

    non-NULL and in the expected (host,user,domain) order.  This is seen

    in valgrind as:

    ==3181== Source and destination overlap in stpcpy(0x19973b48, 0x19973b48)

    ==3181==    at 0x4C2F30A: stpcpy (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)

    ==3181==    by 0x12567A: addgetnetgrentX (string3.h:111)

    ==3181==    by 0x12722D: addgetnetgrent (netgroupcache.c:665)

    ==3181==    by 0x11114C: nscd_run_worker (connections.c:1338)

    ==3181==    by 0x4E3C102: start_thread (pthread_create.c:309)

    ==3181==    by 0x59B81AC: clone (clone.S:111)

    ==3181==

    Fix this by using memmove instead of stpcpy.

diff --git glibc-2.17-c758a686/nscd/netgroupcache.c glibc-2.17-c758a686/nscd/netgroupcache.c

index 5d15aa4..820d823 100644

--- glibc-2.17-c758a686/nscd/netgroupcache.c

+++ glibc-2.17-c758a686/nscd/netgroupcache.c

@@ -216,6 +216,10 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,

 			    const char *nuser = data.val.triple.user;

 			    const char *ndomain = data.val.triple.domain;

+			    size_t hostlen = strlen (nhost ?: "") + 1;

+			    size_t userlen = strlen (nuser ?: "") + 1;

+			    size_t domainlen = strlen (ndomain ?: "") + 1;

+

 			    if (nhost == NULL || nuser == NULL || ndomain == NULL

 				|| nhost > nuser || nuser > ndomain)

 			      {

@@ -233,9 +237,6 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,

 				     : last + strlen (last) + 1 - buffer);

 				/* We have to make temporary copies.  */

-				size_t hostlen = strlen (nhost ?: "") + 1;

-				size_t userlen = strlen (nuser ?: "") + 1;

-				size_t domainlen = strlen (ndomain ?: "") + 1;

 				size_t needed = hostlen + userlen + domainlen;

 				if (buflen - req->key_len - bufused < needed)

@@ -269,9 +270,12 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,

 			      }

 			    char *wp = buffer + buffilled;

-			    wp = stpcpy (wp, nhost) + 1;

-			    wp = stpcpy (wp, nuser) + 1;

-			    wp = stpcpy (wp, ndomain) + 1;

+			    wp = memmove (wp, nhost ?: "", hostlen);

+			    wp += hostlen;

+			    wp = memmove (wp, nuser ?: "", userlen);

+			    wp += userlen;

+			    wp = memmove (wp, ndomain ?: "", domainlen);

+			    wp += domainlen;

 			    buffilled = wp - buffer;

 			    ++nentries;

 			  }