|
 |
b8f1b8 |
diff -up shadow-4.8/lib/defines.h.long-entry shadow-4.8/lib/defines.h
|
|
|
b8f1b8 |
--- shadow-4.8/lib/defines.h.long-entry 2020-01-13 10:29:45.288957339 +0100
|
|
|
b8f1b8 |
+++ shadow-4.8/lib/defines.h 2020-01-13 10:30:47.482902954 +0100
|
|
|
b8f1b8 |
@@ -388,6 +388,9 @@ extern char *strerror ();
|
|
|
b8f1b8 |
# endif
|
|
|
b8f1b8 |
#endif
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
+/* Maximum length of passwd entry */
|
|
|
b8f1b8 |
+#define PASSWD_ENTRY_MAX_LENGTH 32768
|
|
|
b8f1b8 |
+
|
|
|
b8f1b8 |
#ifdef HAVE_SECURE_GETENV
|
|
|
b8f1b8 |
# define shadow_getenv(name) secure_getenv(name)
|
|
|
b8f1b8 |
# else
|
|
|
b8f1b8 |
diff -up shadow-4.8/lib/pwio.c.long-entry shadow-4.8/lib/pwio.c
|
|
|
b8f1b8 |
--- shadow-4.8/lib/pwio.c.long-entry 2019-07-23 17:26:08.000000000 +0200
|
|
|
b8f1b8 |
+++ shadow-4.8/lib/pwio.c 2020-01-13 10:29:45.288957339 +0100
|
|
|
b8f1b8 |
@@ -79,7 +79,10 @@ static int passwd_put (const void *ent,
|
|
|
b8f1b8 |
|| (pw->pw_gid == (gid_t)-1)
|
|
|
b8f1b8 |
|| (valid_field (pw->pw_gecos, ":\n") == -1)
|
|
|
b8f1b8 |
|| (valid_field (pw->pw_dir, ":\n") == -1)
|
|
|
b8f1b8 |
- || (valid_field (pw->pw_shell, ":\n") == -1)) {
|
|
|
b8f1b8 |
+ || (valid_field (pw->pw_shell, ":\n") == -1)
|
|
|
b8f1b8 |
+ || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
|
|
|
b8f1b8 |
+ strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
|
|
|
b8f1b8 |
+ strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
|
|
|
b8f1b8 |
return -1;
|
|
|
b8f1b8 |
}
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
diff -up shadow-4.8/lib/sgetpwent.c.long-entry shadow-4.8/lib/sgetpwent.c
|
|
|
b8f1b8 |
--- shadow-4.8/lib/sgetpwent.c.long-entry 2019-10-05 03:23:58.000000000 +0200
|
|
|
b8f1b8 |
+++ shadow-4.8/lib/sgetpwent.c 2020-01-13 10:29:45.288957339 +0100
|
|
|
b8f1b8 |
@@ -57,7 +57,7 @@
|
|
|
b8f1b8 |
struct passwd *sgetpwent (const char *buf)
|
|
|
b8f1b8 |
{
|
|
|
b8f1b8 |
static struct passwd pwent;
|
|
|
b8f1b8 |
- static char pwdbuf[1024];
|
|
|
b8f1b8 |
+ static char pwdbuf[PASSWD_ENTRY_MAX_LENGTH];
|
|
|
b8f1b8 |
register int i;
|
|
|
b8f1b8 |
register char *cp;
|
|
|
b8f1b8 |
char *fields[NFIELDS];
|
|
|
b8f1b8 |
@@ -67,8 +67,10 @@ struct passwd *sgetpwent (const char *bu
|
|
|
b8f1b8 |
* the password structure remain valid.
|
|
|
b8f1b8 |
*/
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
- if (strlen (buf) >= sizeof pwdbuf)
|
|
|
b8f1b8 |
+ if (strlen (buf) >= sizeof pwdbuf) {
|
|
|
b8f1b8 |
+ fprintf (stderr, "Too long passwd entry encountered, file corruption?\n");
|
|
|
b8f1b8 |
return 0; /* fail if too long */
|
|
|
b8f1b8 |
+ }
|
|
|
b8f1b8 |
strcpy (pwdbuf, buf);
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
/*
|
|
|
b8f1b8 |
diff -up shadow-4.8/lib/sgetspent.c.long-entry shadow-4.8/lib/sgetspent.c
|
|
|
b8f1b8 |
--- shadow-4.8/lib/sgetspent.c.long-entry 2019-07-23 17:26:08.000000000 +0200
|
|
|
b8f1b8 |
+++ shadow-4.8/lib/sgetspent.c 2020-01-13 10:29:45.289957322 +0100
|
|
|
b8f1b8 |
@@ -48,7 +48,7 @@
|
|
|
b8f1b8 |
*/
|
|
|
b8f1b8 |
struct spwd *sgetspent (const char *string)
|
|
|
b8f1b8 |
{
|
|
|
b8f1b8 |
- static char spwbuf[1024];
|
|
|
b8f1b8 |
+ static char spwbuf[PASSWD_ENTRY_MAX_LENGTH];
|
|
|
b8f1b8 |
static struct spwd spwd;
|
|
|
b8f1b8 |
char *fields[FIELDS];
|
|
|
b8f1b8 |
char *cp;
|
|
|
b8f1b8 |
@@ -61,6 +61,7 @@ struct spwd *sgetspent (const char *stri
|
|
|
b8f1b8 |
*/
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
if (strlen (string) >= sizeof spwbuf) {
|
|
|
b8f1b8 |
+ fprintf (stderr, "Too long shadow entry encountered, file corruption?\n");
|
|
|
b8f1b8 |
return 0; /* fail if too long */
|
|
|
b8f1b8 |
}
|
|
|
b8f1b8 |
strcpy (spwbuf, string);
|
|
|
b8f1b8 |
diff -up shadow-4.8/lib/shadowio.c.long-entry shadow-4.8/lib/shadowio.c
|
|
|
b8f1b8 |
--- shadow-4.8/lib/shadowio.c.long-entry 2019-07-23 17:26:08.000000000 +0200
|
|
|
b8f1b8 |
+++ shadow-4.8/lib/shadowio.c 2020-01-13 10:29:45.289957322 +0100
|
|
|
b8f1b8 |
@@ -79,7 +79,9 @@ static int shadow_put (const void *ent,
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
if ( (NULL == sp)
|
|
|
b8f1b8 |
|| (valid_field (sp->sp_namp, ":\n") == -1)
|
|
|
b8f1b8 |
- || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
|
|
|
b8f1b8 |
+ || (valid_field (sp->sp_pwdp, ":\n") == -1)
|
|
|
b8f1b8 |
+ || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
|
|
|
b8f1b8 |
+ 1000 > PASSWD_ENTRY_MAX_LENGTH)) {
|
|
|
b8f1b8 |
return -1;
|
|
|
b8f1b8 |
}
|
|
|
b8f1b8 |
|