12745e
#
12745e
# Posted upstream 2015-06-18:
12745e
# https://www.sourceware.org/ml/libc-alpha/2015-06/msg00629.html
12745e
#
12745e
diff --git glibc-2.17-c758a686/inet/rcmd.c glibc-2.17-c758a686/inet/rcmd.c
12745e
index 98b3735..91623b0 100644
12745e
--- glibc-2.17-c758a686/inet/rcmd.c
12745e
+++ glibc-2.17-c758a686/inet/rcmd.c
12745e
@@ -809,29 +809,38 @@ __validuser2_sa(hostf, ra, ralen, luser, ruser, rhost)
12745e
 	*p = '\0';              /* <nul> terminate username (+host?) */
12745e
 
12745e
 	/* buf -> host(?) ; user -> username(?) */
12745e
+	if (*buf == '\0')
12745e
+	  break;
12745e
+	if (*user == '\0')
12745e
+	  user = luser;
12745e
+
12745e
+	/* First check the user part.  This is an optimization, since
12745e
+	   one should always check the host first in order to detect
12745e
+	   negative host checks (which we check for later).  */
12745e
+	ucheck = __icheckuser (user, ruser);
12745e
+
12745e
+	/* Either we found the user, or we didn't and this is a
12745e
+	   negative host check.  We must do the negative host lookup
12745e
+	   in order to preserve the semantics of stopping on this line
12745e
+	   before processing others.  */
12745e
+	if (ucheck != 0 || *buf == '-') {
12745e
+
12745e
+	    /* Next check host part */
12745e
+	    hcheck = __checkhost_sa (ra, ralen, buf, rhost);
12745e
+
12745e
+	    /* Negative '-host user(?)' match?  */
12745e
+	    if (hcheck < 0)
12745e
+		break;
12745e
 
12745e
-	/* First check host part */
12745e
-	hcheck = __checkhost_sa (ra, ralen, buf, rhost);
12745e
-
12745e
-	if (hcheck < 0)
12745e
-	    break;
12745e
-
12745e
-	if (hcheck) {
12745e
-	    /* Then check user part */
12745e
-	    if (! (*user))
12745e
-		user = luser;
12745e
-
12745e
-	    ucheck = __icheckuser (user, ruser);
12745e
-
12745e
-	    /* Positive 'host user' match? */
12745e
-	    if (ucheck > 0) {
12745e
+	    /* Positive 'host user' match?  */
12745e
+	    if (hcheck > 0 && ucheck > 0) {
12745e
 		retval = 0;
12745e
 		break;
12745e
 	    }
12745e
 
12745e
-	    /* Negative 'host -user' match? */
12745e
-	    if (ucheck < 0)
12745e
-		break;
12745e
+	    /* Negative 'host -user' match?  */
12745e
+	    if (hcheck > 0 && ucheck < 0)
12745e
+	      break;
12745e
 
12745e
 	    /* Neither, go on looking for match */
12745e
 	}