[BusyBox-cvs] CVS update of busybox (archival/tar.c coreutils/id.c coreutils/ls.c coreutils/whoami.c include/libbb.h libbb/my_getgrgid.c libbb/my_getpwuid.c libbb/procps.c sysklogd/logger.c)
Erik Andersen
andersen at codepoet.org
Thu Aug 26 22:18:59 UTC 2004
Date: Thursday, August 26, 2004 @ 16:18:59
Author: andersen
Path: /var/cvs/busybox
Modified: archival/tar.c (1.194 -> 1.195) coreutils/id.c (1.24 -> 1.25)
coreutils/ls.c (1.110 -> 1.111) coreutils/whoami.c (1.21 ->
1.22) include/libbb.h (1.133 -> 1.134) libbb/my_getgrgid.c (1.7
-> 1.8) libbb/my_getpwuid.c (1.7 -> 1.8) libbb/procps.c (1.13 ->
1.14) sysklogd/logger.c (1.39 -> 1.40)
Tito writes:
Hi,
I've spent the half night staring at the devilish my_getpwuid and my_getgrgid functions
trying to find out a way to avoid actual and future potential buffer overflow problems
without breaking existing code.
Finally I've found a not intrusive way to do this that surely doesn't break existing code
and fixes a couple of problems too.
The attached patch:
1) changes the behaviour of my_getpwuid and my_getgrgid to avoid potetntial buffer overflows
2) fixes all occurences of this function calls in tar.c , id.c , ls.c, whoami.c, logger.c, libbb.h.
3) The behaviour of tar, ls and logger is unchanged.
4) The behavior of ps with somewhat longer usernames messing up output is fixed.
5) The only bigger change was the increasing of size of the buffers in id.c to avoid
false negatives (unknown user: xxxxxx) with usernames longer than 8 chars.
The value i used ( 32 chars ) was taken from the tar header ( see gname and uname).
Maybe this buffers can be reduced a bit ( to 16 or whatever ), this is up to you.
6) The increase of size of the binary is not so dramatic:
size busybox
text data bss dec hex filename
239568 2300 36816 278684 4409c busybox
size busybox_fixed
text data bss dec hex filename
239616 2300 36816 278732 440cc busybox
7) The behaviour of whoami changed:
actually it prints out an username cut down to the size of the buffer.
This could be fixed by increasing the size of the buffer as in id.c or
avoid the use of my_getpwuid and use getpwuid directly instead.
Maybe this colud be also remain unchanged......
Please apply if you think it is ok to do so.
The diff applies on today's cvs tarball (2004-08-25).
Thanks in advance,
Ciao,
Tito
Index: busybox/archival/tar.c
diff -u busybox/archival/tar.c:1.194 busybox/archival/tar.c:1.195
--- busybox/archival/tar.c:1.194 Mon Jul 26 03:11:11 2004
+++ busybox/archival/tar.c Thu Aug 26 16:18:56 2004
@@ -234,9 +234,9 @@
TAR_MAGIC_LEN + TAR_VERSION_LEN);
/* Enter the user and group names (default to root if it fails) */
- if (my_getpwuid(header.uname, statbuf->st_uid) == NULL)
+ if (my_getpwuid(header.uname, statbuf->st_uid, sizeof(header.uname)) == NULL)
strcpy(header.uname, "root");
- if (my_getgrgid(header.gname, statbuf->st_gid) == NULL)
+ if (my_getgrgid(header.gname, statbuf->st_gid, sizeof(header.gname)) == NULL)
strcpy(header.gname, "root");
if (tbInfo->hlInfo) {
Index: busybox/coreutils/id.c
diff -u busybox/coreutils/id.c:1.24 busybox/coreutils/id.c:1.25
--- busybox/coreutils/id.c:1.24 Mon Mar 15 01:28:20 2004
+++ busybox/coreutils/id.c Thu Aug 26 16:18:57 2004
@@ -40,7 +40,7 @@
extern int id_main(int argc, char **argv)
{
- char user[9], group[9];
+ char user[32], group[32];
long pwnam, grnam;
int uid, gid;
int flags;
@@ -64,12 +64,12 @@
uid = geteuid();
gid = getegid();
}
- my_getpwuid(user, uid);
+ my_getpwuid(user, uid, sizeof(user));
} else {
safe_strncpy(user, argv[optind], sizeof(user));
gid = my_getpwnamegid(user);
}
- my_getgrgid(group, gid);
+ my_getgrgid(group, gid, sizeof(group));
pwnam=my_getpwnam(user);
grnam=my_getgrnam(group);
Index: busybox/coreutils/ls.c
diff -u busybox/coreutils/ls.c:1.110 busybox/coreutils/ls.c:1.111
--- busybox/coreutils/ls.c:1.110 Mon Jul 26 03:11:12 2004
+++ busybox/coreutils/ls.c Thu Aug 26 16:18:57 2004
@@ -683,9 +683,9 @@
break;
case LIST_ID_NAME:
#ifdef CONFIG_FEATURE_LS_USERNAME
- my_getpwuid(scratch, dn->dstat.st_uid);
+ my_getpwuid(scratch, dn->dstat.st_uid, sizeof(scratch));
printf("%-8.8s ", scratch);
- my_getgrgid(scratch, dn->dstat.st_gid);
+ my_getgrgid(scratch, dn->dstat.st_gid, sizeof(scratch));
printf("%-8.8s", scratch);
column += 17;
break;
Index: busybox/coreutils/whoami.c
diff -u busybox/coreutils/whoami.c:1.21 busybox/coreutils/whoami.c:1.22
--- busybox/coreutils/whoami.c:1.21 Wed Mar 19 02:11:34 2003
+++ busybox/coreutils/whoami.c Thu Aug 26 16:18:57 2004
@@ -36,7 +36,7 @@
bb_show_usage();
uid = geteuid();
- if (my_getpwuid(user, uid)) {
+ if (my_getpwuid(user, uid, sizeof(user))) {
puts(user);
bb_fflush_stdout_and_exit(EXIT_SUCCESS);
}
Index: busybox/include/libbb.h
diff -u busybox/include/libbb.h:1.133 busybox/include/libbb.h:1.134
--- busybox/include/libbb.h:1.133 Mon Aug 2 18:14:01 2004
+++ busybox/include/libbb.h Thu Aug 26 16:18:58 2004
@@ -230,8 +230,8 @@
* increases target size and is often not needed embedded systems. */
extern long my_getpwnam(const char *name);
extern long my_getgrnam(const char *name);
-extern char * my_getpwuid(char *name, long uid);
-extern char * my_getgrgid(char *group, long gid);
+extern char * my_getpwuid(char *name, long uid, int bufsize);
+extern char * my_getgrgid(char *group, long gid, int bufsize);
extern long my_getpwnamegid(const char *name);
extern char *bb_askpass(int timeout, const char * prompt);
Index: busybox/libbb/my_getgrgid.c
diff -u busybox/libbb/my_getgrgid.c:1.7 busybox/libbb/my_getgrgid.c:1.8
--- busybox/libbb/my_getgrgid.c:1.7 Mon Mar 15 01:28:43 2004
+++ busybox/libbb/my_getgrgid.c Thu Aug 26 16:18:58 2004
@@ -27,16 +27,16 @@
/* gets a groupname given a gid */
-char * my_getgrgid(char *group, long gid)
+char * my_getgrgid(char *group, long gid, int bufsize)
{
struct group *mygroup;
mygroup = getgrgid(gid);
if (mygroup==NULL) {
- sprintf(group, "%ld", gid);
+ snprintf(group, bufsize, "%ld", gid);
return NULL;
} else {
- return strcpy(group, mygroup->gr_name);
+ return safe_strncpy(group, mygroup->gr_name, bufsize);
}
}
Index: busybox/libbb/my_getpwuid.c
diff -u busybox/libbb/my_getpwuid.c:1.7 busybox/libbb/my_getpwuid.c:1.8
--- busybox/libbb/my_getpwuid.c:1.7 Mon Mar 15 01:28:43 2004
+++ busybox/libbb/my_getpwuid.c Thu Aug 26 16:18:58 2004
@@ -28,16 +28,16 @@
/* gets a username given a uid */
-char * my_getpwuid(char *name, long uid)
+char * my_getpwuid(char *name, long uid, int bufsize)
{
struct passwd *myuser;
myuser = getpwuid(uid);
if (myuser==NULL) {
- sprintf(name, "%ld", (long)uid);
+ snprintf(name, bufsize, "%ld", (long)uid);
return NULL;
} else {
- return strcpy(name, myuser->pw_name);
+ return safe_strncpy(name, myuser->pw_name, bufsize);
}
}
Index: busybox/libbb/procps.c
diff -u busybox/libbb/procps.c:1.13 busybox/libbb/procps.c:1.14
--- busybox/libbb/procps.c:1.13 Tue Jan 27 13:17:39 2004
+++ busybox/libbb/procps.c Thu Aug 26 16:18:58 2004
@@ -57,7 +57,7 @@
sprintf(status, "/proc/%d", pid);
if(stat(status, &sb))
continue;
- my_getpwuid(curstatus.user, sb.st_uid);
+ my_getpwuid(curstatus.user, sb.st_uid, sizeof(curstatus.user));
sprintf(status, "/proc/%d/stat", pid);
if((fp = fopen(status, "r")) == NULL)
Index: busybox/sysklogd/logger.c
diff -u busybox/sysklogd/logger.c:1.39 busybox/sysklogd/logger.c:1.40
--- busybox/sysklogd/logger.c:1.39 Mon Mar 15 01:29:16 2004
+++ busybox/sysklogd/logger.c Thu Aug 26 16:18:59 2004
@@ -108,7 +108,7 @@
char buf[1024], name[128];
/* Fill out the name string early (may be overwritten later) */
- my_getpwuid(name, geteuid());
+ my_getpwuid(name, geteuid(), sizeof(name));
/* Parse any options */
while ((opt = getopt(argc, argv, "p:st:")) > 0) {
More information about the busybox-cvs
mailing list