From eeef53917864600e0f5ac42ce5c3d884967012a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Mon, 5 Feb 2018 10:31:47 +0100 Subject: [PATCH 1/2] warnquota: Check snprintf() for overflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GCC 8 with GNU libc 2.27 prerelease warns: gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -fPIC -I/usr/include/tirpc -c -o warnquota.o warnquota.c warnquota.c: In function ‘lookup_user’: warnquota.c:415:29: warning: ‘%s’ directive output may be truncated writing up to 2047 bytes into a region of size 255 [-Wformat-truncation=] snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, user); ^~ warnquota.c:415:2: note: ‘snprintf’ output 4 or more bytes (assuming 2051) into a destination of size 256 snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, user); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ warnquota.c: In function ‘warn_quota’: warnquota.c:896:51: warning: ‘%s’ directive output may be truncated writing up to 2047 bytes into a region of size 2041 [-Wformat-truncation=] snprintf(config->ldap_uri, CNF_BUFFER, "ldap://%s:%d", config->ldap_host, config->ldap_port); ^~ ~~~~~~~~~~~~~~~~~ warnquota.c:896:4: note: ‘snprintf’ output between 10 and 2067 bytes into a destination of size 2048 snprintf(config->ldap_uri, CNF_BUFFER, "ldap://%s:%d", config->ldap_host, config->ldap_port); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is patch fixes it by catching the cases when snprintf() truncates and reporting an error. Perfect fix would fall back into dynamically allocated buffers but I think that would make these corner case too complicated provided nobody had yet complained about them. Signed-off-by: Petr Písař --- warnquota.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/warnquota.c b/warnquota.c index 073c45e..bc11055 100644 --- a/warnquota.c +++ b/warnquota.c @@ -412,7 +412,13 @@ static char *lookup_user(struct configparams *config, char *user) } /* search for the offender_name in ldap */ - snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, user); + if (256 <= snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, + user)) { + errstr(_("Could not format LDAP search filter for %s user and " + "%s search attribute due to excessive length.\n"), + user, config->ldap_search_attr); + return NULL; + } ret = ldap_search_ext_s(ldapconn, config->ldap_basedn, LDAP_SCOPE_SUBTREE, searchbuf, NULL, 0, NULL, NULL, NULL, @@ -893,7 +899,14 @@ cc_parse_err: if (config->use_ldap_mail) { if (!config->ldap_uri[0]) { - snprintf(config->ldap_uri, CNF_BUFFER, "ldap://%s:%d", config->ldap_host, config->ldap_port); + if (CNF_BUFFER <= snprintf(config->ldap_uri, CNF_BUFFER, + "ldap://%s:%d", config->ldap_host, + config->ldap_port)) { + errstr(_("Could not format LDAP URI because " + "it's longer than %d bytes.\n"), + CNF_BUFFER); + return -1; + } errstr(_("LDAP library version >= 2.3 detected. Please use LDAP_URI instead of hostname and port.\nGenerated URI %s\n"), config->ldap_uri); } } -- 2.13.6