emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity
37ae232080
shadow/libmisc
History
Samanta Navarro 37ae232080 Correctly handle illegal system file in tz 
If the file referenced by ENV_TZ has a zero length string, then an out
of boundary write occurs. Also the result can be wrong because it is
assumed that the file will always end with a newline.

Only override a newline character with '\0' to avoid these cases.

This cannot be considered to be security relevant because login.defs
and its contained references to system files should be trusted to begin
with.

Proof of Concept:

1. Compile shadow's su with address sanitizer and --without-libpam

2. Setup your /etc/login.defs to contain ENV_TZ=/etc/tzname

3. Prepare /etc/tzname to contain a '\0' byte at the beginning

`python -c "print('\x00')" > /etc/tzname`

4. Use su

`su -l`

You can see the following output:

`tz.c:45:8: runtime error: index 18446744073709551615 out of bounds for type 'char [8192]'`

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
2023-02-01 15:47:35 -06:00
..
.indent.pro Commit the last version from the PLD CVS repository. 2007-10-07 14:36:51 +00:00
addgrps.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
age.c Update licensing info 2021-12-23 19:36:50 -06:00
agetpass.c agetpass: Hook into build-system 2022-12-05 10:47:19 +01:00
audit_help.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
basename.c Update licensing info 2021-12-23 19:36:50 -06:00
bit.c Add bit manipulation functions 2023-01-30 18:24:15 +01:00
btrfs.c Declare read-only data const 2022-08-06 11:27:56 -05:00
chkname.c shadow: use relaxed usernames 2022-09-02 20:27:14 -05:00
chkname.h Update licensing info 2021-12-23 19:36:50 -06:00
chowndir.c Avoid races in chown_tree() 2022-08-17 12:34:01 -05:00
chowntty.c Merge pull request #451 from hallyn/2021-12-05/license 2022-01-02 18:38:42 -06:00
cleanup_group.c Merge pull request #451 from hallyn/2021-12-05/license 2022-01-02 18:38:42 -06:00
cleanup_user.c Merge pull request #451 from hallyn/2021-12-05/license 2022-01-02 18:38:42 -06:00
cleanup.c Update licensing info 2021-12-23 19:36:50 -06:00
console.c Use strlcpy(3) instead of its pattern 2022-12-22 18:03:39 -06:00
copydir.c copydir: fix impl usage 2023-01-25 12:31:17 +01:00
csrand.c Unoptimize the higher part of the domain of csrand_uniform() 2023-01-30 18:24:15 +01:00
date_to_str.c Use strlcpy(3) instead of its pattern 2022-12-22 18:03:39 -06:00
entry.c Update licensing info 2021-12-23 19:36:50 -06:00
env.c Drop redundant declaration 2023-01-25 12:31:17 +01:00
failure.c Cosmetic fixes 2022-12-22 10:31:43 +01:00
failure.h Disable utmpx permanently 2022-12-22 10:31:43 +01:00
find_new_gid.c libmisc: minimum id check for system accounts 2022-10-06 20:09:35 -05:00
find_new_sub_gids.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
find_new_sub_uids.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
find_new_uid.c libmisc: minimum id check for system accounts 2022-10-06 20:09:35 -05:00
getdate.h Update licensing info 2021-12-23 19:36:50 -06:00
getdate.y Use isdigit(3) instead of a reimplementation of it 2021-12-29 02:41:09 +01:00
getgr_nam_gid.c Update licensing info 2021-12-23 19:36:50 -06:00
getrange.c Declare read-only parameters const 2022-08-06 11:27:56 -05:00
gettime.c Avoid comparisons of different signs 2023-01-25 12:31:17 +01:00
hushed.c Update licensing info 2021-12-23 19:36:50 -06:00
idmapping.c Use WIDTHOF() instead of its expansion 2023-01-27 21:48:37 -06:00
idmapping.h Add include for uid_t 2022-08-06 11:27:56 -05:00
isexpired.c Update licensing info 2021-12-23 19:36:50 -06:00
limits.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
list.c Update licensing info 2021-12-23 19:36:50 -06:00
log.c Update licensing info 2021-12-23 19:36:50 -06:00
loginprompt.c Assume SIGTSTP is defined 2022-12-15 16:22:05 -06:00
mail.c Update licensing info 2021-12-23 19:36:50 -06:00
Makefile.am Add bit manipulation functions 2023-01-30 18:24:15 +01:00
motd.c Drop register keyword 2022-08-06 11:27:56 -05:00
myname.c Update licensing info 2021-12-23 19:36:50 -06:00
obscure.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
pam_pass_non_interactive.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
pam_pass.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
prefix_flag.c Use strict prototypes 2022-01-03 15:09:17 +01:00
pwd2spwd.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
pwd_init.c Assume SIGTTOU is defined 2022-12-15 16:22:05 -06:00
pwdcheck.c Don't redefine errno(3) 2022-12-22 11:43:29 +01:00
remove_tree.c Avoid races in remove_tree() 2022-08-17 12:34:01 -05:00
rlogin.c Assume B[0-9]* macros are defined 2022-12-15 16:22:05 -06:00
root_flag.c libmisc/root_flag: add tips for --root flag only support abspath 2022-08-06 15:04:06 -05:00
salt.c Rewrite csrand_interval() as a wrapper around csrand_uniform() 2023-01-27 21:48:37 -06:00
setugid.c Update licensing info 2021-12-23 19:36:50 -06:00
setupenv.c Merge pull request #451 from hallyn/2021-12-05/license 2022-01-02 18:38:42 -06:00
shell.c Do not drop const qualifier for Basename 2022-01-03 15:09:17 +01:00
strtoday.c strtoday.c: remove unused defines.h inclusion 2022-12-22 10:39:45 -06:00
sub.c Update licensing info 2021-12-23 19:36:50 -06:00
sulog.c Update licensing info 2021-12-23 19:36:50 -06:00
ttytype.c Update licensing info 2021-12-23 19:36:50 -06:00
tz.c Correctly handle illegal system file in tz 2023-02-01 15:47:35 -06:00
ulimit.c Remove comments that survived the Helicoprion 2022-12-15 16:22:05 -06:00
user_busy.c Disable utmpx permanently 2022-12-22 10:31:43 +01:00
utmp.c Use strlcpy(3) instead of its pattern 2022-12-22 18:03:39 -06:00
valid.c Update licensing info 2021-12-23 19:36:50 -06:00
xgetgrgid.c Assume getgrgid_r(3) exists 2022-12-15 16:22:05 -06:00
xgetgrnam.c libmisc: fix grammar 2023-01-26 22:44:39 -06:00
xgetpwnam.c libmisc: fix grammar 2023-01-26 22:44:39 -06:00
xgetpwuid.c Assume getpwuid_r(3) exists 2022-12-15 16:22:05 -06:00
xgetspnam.c libmisc: fix grammar 2023-01-26 22:44:39 -06:00
xgetXXbyYY.c libmisc: fix grammar 2023-01-26 22:44:39 -06:00
xmalloc.c Don't test for NULL before calling free(3) 2022-09-29 16:03:53 +02:00
yesno.c Update licensing info 2021-12-23 19:36:50 -06:00