|
 |
5de29b |
commit c44496df2f090a56d3bf75df930592dac6bba46f
|
|
|
5de29b |
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
|
|
|
5de29b |
Date: Wed Mar 12 17:27:22 2014 +0530
|
|
|
5de29b |
|
|
|
5de29b |
Provide correct buffer length to netgroup queries in nscd (BZ #16695)
|
|
|
5de29b |
|
|
|
5de29b |
The buffer to query netgroup entries is allocated sufficient space for
|
|
|
5de29b |
the netgroup entries and the key to be appended at the end, but it
|
|
|
5de29b |
sends in an incorrect available length to the NSS netgroup query
|
|
|
5de29b |
functions, resulting in overflow of the buffer in some special cases.
|
|
|
5de29b |
The fix here is to factor in the key length when sending the available
|
|
|
5de29b |
buffer and buffer length to the query functions.
|
|
|
5de29b |
|
|
|
12745e |
diff --git glibc-2.17-c758a686/nscd/netgroupcache.c glibc-2.17-c758a686/nscd/netgroupcache.c
|
|
|
5de29b |
index 426d3c5..5ba1e1f 100644
|
|
|
12745e |
--- glibc-2.17-c758a686/nscd/netgroupcache.c
|
|
|
12745e |
+++ glibc-2.17-c758a686/nscd/netgroupcache.c
|
|
|
5de29b |
@@ -202,7 +202,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
|
|
|
5de29b |
{
|
|
|
5de29b |
int e;
|
|
|
5de29b |
status = getfct.f (&data, buffer + buffilled,
|
|
|
5de29b |
- buflen - buffilled, &e);
|
|
|
5de29b |
+ buflen - buffilled - req->key_len, &e);
|
|
|
5de29b |
if (status == NSS_STATUS_RETURN
|
|
|
5de29b |
|| status == NSS_STATUS_NOTFOUND)
|
|
|
5de29b |
/* This was either the last one for this group or the
|