From eeef53917864600e0f5ac42ce5c3d884967012a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Mon, 5 Feb 2018 10:31:47 +0100
Subject: [PATCH 1/2] warnquota: Check snprintf() for overflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
GCC 8 with GNU libc 2.27 prerelease warns:
gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -fPIC -I/usr/include/tirpc -c -o warnquota.o warnquota.c
warnquota.c: In function ‘lookup_user’:
warnquota.c:415:29: warning: ‘%s’ directive output may be truncated writing up to 2047 bytes into a region of size 255 [-Wformat-truncation=]
snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, user);
^~
warnquota.c:415:2: note: ‘snprintf’ output 4 or more bytes (assuming 2051) into a destination of size 256
snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, user);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warnquota.c: In function ‘warn_quota’:
warnquota.c:896:51: warning: ‘%s’ directive output may be truncated writing up to 2047 bytes into a region of size 2041 [-Wformat-truncation=]
snprintf(config->ldap_uri, CNF_BUFFER, "ldap://%s:%d", config->ldap_host, config->ldap_port);
^~ ~~~~~~~~~~~~~~~~~
warnquota.c:896:4: note: ‘snprintf’ output between 10 and 2067 bytes into a destination of size 2048
snprintf(config->ldap_uri, CNF_BUFFER, "ldap://%s:%d", config->ldap_host, config->ldap_port);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This is patch fixes it by catching the cases when snprintf() truncates and
reporting an error.
Perfect fix would fall back into dynamically allocated buffers but
I think that would make these corner case too complicated provided
nobody had yet complained about them.
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
warnquota.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/warnquota.c b/warnquota.c
index 073c45e..bc11055 100644
--- a/warnquota.c
+++ b/warnquota.c
@@ -412,7 +412,13 @@ static char *lookup_user(struct configparams *config, char *user)
}
/* search for the offender_name in ldap */
- snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, user);
+ if (256 <= snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr,
+ user)) {
+ errstr(_("Could not format LDAP search filter for %s user and "
+ "%s search attribute due to excessive length.\n"),
+ user, config->ldap_search_attr);
+ return NULL;
+ }
ret = ldap_search_ext_s(ldapconn,
config->ldap_basedn, LDAP_SCOPE_SUBTREE,
searchbuf, NULL, 0, NULL, NULL, NULL,
@@ -893,7 +899,14 @@ cc_parse_err:
if (config->use_ldap_mail)
{
if (!config->ldap_uri[0]) {
- snprintf(config->ldap_uri, CNF_BUFFER, "ldap://%s:%d", config->ldap_host, config->ldap_port);
+ if (CNF_BUFFER <= snprintf(config->ldap_uri, CNF_BUFFER,
+ "ldap://%s:%d", config->ldap_host,
+ config->ldap_port)) {
+ errstr(_("Could not format LDAP URI because "
+ "it's longer than %d bytes.\n"),
+ CNF_BUFFER);
+ return -1;
+ }
errstr(_("LDAP library version >= 2.3 detected. Please use LDAP_URI instead of hostname and port.\nGenerated URI %s\n"), config->ldap_uri);
}
}
--
2.13.6