jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-11-27 02:42:46 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

The +@netgroup/-@netgroup NIS password overrides can fail in

Browse Source 
some cases due to a subtle bug. Specifically, if you override
	an NIS user's shell, /usr/bin/login and /usr/bin/su (and probably
	other commands) can end up with bogus data for the pw_shell
	member of the passwd structure *if* the do an endpwent(),
	thereby preventing logins.

	This happpens because the text fields in the passwd structure
	(pw_name, pw_passwd, pw_gecos, pw_class, pw_dir and pw_shell)
	are returned to the calling program as pointers to dycamically
	allocated buffers, rather than pointers to static buffers as
	they should be. Once endpwent() is called, the dynamic buffers
	are free()ed, which invalidates the data returned by the
	library functions.

Note: Bill promises a more elegant solution in post-2.0.5R. This fix
	is only a work-around.

Submitted by:	Bill Paul
This commit is contained in:
David Greenman 1995-06-02 11:23:24 +00:00
parent 72ea2524f2
commit 3ab30975ab
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/releng/2.0.5/; revision=8975
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/libc/gen/getpwent.c
View File

@ -496,6 +496,15 @@ static void
_pw_breakout_yp(struct passwd *pw, char *result, int master)
{
char *s;
static char name[UT_NAMESIZE+2], passwd[_PASSWORD_LEN], class[1024];
static char gecos[1024], dir[MAXPATHLEN], shell[MAXPATHLEN];
strcpy(name, pw->pw_name); pw->pw_name = (char *)&name;
strcpy(passwd, pw->pw_passwd); pw->pw_passwd = (char *)&passwd;
strcpy(class, pw->pw_class); pw->pw_class = (char *)&class;
strcpy(gecos, pw->pw_gecos); pw->pw_gecos = (char *)&gecos;
strcpy(dir, pw->pw_dir); pw->pw_dir = (char *)&dir;
strcpy(shell, pw->pw_shell); pw->pw_shell = (char *)&shell;
s = strsep(&result, ":"); /* name */
if(!(pw->pw_fields & _PWF_NAME) || (pw->pw_name[0] == '+')) {