37ae232080
If the file referenced by ENV_TZ has a zero length string, then an out
of boundary write occurs. Also the result can be wrong because it is
assumed that the file will always end with a newline.
Only override a newline character with '\0' to avoid these cases.
This cannot be considered to be security relevant because login.defs
and its contained references to system files should be trusted to begin
with.
Proof of Concept:
1. Compile shadow's su with address sanitizer and --without-libpam
2. Setup your /etc/login.defs to contain ENV_TZ=/etc/tzname
3. Prepare /etc/tzname to contain a '\0' byte at the beginning
`python -c "print('\x00')" > /etc/tzname`
4. Use su
`su -l`
You can see the following output:
`tz.c:45:8: runtime error: index 18446744073709551615 out of bounds for type 'char [8192]'`
Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
59 lines
1.3 KiB
C
59 lines
1.3 KiB
C
/*
|
|
* SPDX-FileCopyrightText: 1991 - 1994, Julianne Frances Haugh
|
|
* SPDX-FileCopyrightText: 1991 - 1994, Chip Rosenthal
|
|
* SPDX-FileCopyrightText: 1996 - 1998, Marek Michałkiewicz
|
|
* SPDX-FileCopyrightText: 2003 - 2005, Tomasz Kłoczko
|
|
* SPDX-FileCopyrightText: 2007 - 2010, Nicolas François
|
|
*
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
|
*/
|
|
|
|
#include <config.h>
|
|
|
|
#ifndef USE_PAM
|
|
|
|
#ident "$Id$"
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include "defines.h"
|
|
#include "prototypes.h"
|
|
#include "getdef.h"
|
|
|
|
/*
|
|
* tz - return local timezone name
|
|
*
|
|
* tz() determines the name of the local timezone by reading the
|
|
* contents of the file named by ``fname''.
|
|
*/
|
|
/*@observer@*/const char *tz (const char *fname)
|
|
{
|
|
FILE *fp = NULL;
|
|
static char tzbuf[BUFSIZ];
|
|
const char *def_tz = "TZ=CST6CDT";
|
|
|
|
fp = fopen (fname, "r");
|
|
if ( (NULL == fp)
|
|
|| (fgets (tzbuf, (int) sizeof (tzbuf), fp) == NULL)) {
|
|
def_tz = getdef_str ("ENV_TZ");
|
|
if ((NULL == def_tz) || ('/' == def_tz[0])) {
|
|
def_tz = "TZ=CST6CDT";
|
|
}
|
|
|
|
strcpy (tzbuf, def_tz);
|
|
} else {
|
|
/* Remove optional trailing '\n'. */
|
|
tzbuf[strcspn (tzbuf, "\n")] = '\0';
|
|
}
|
|
|
|
if (NULL != fp) {
|
|
(void) fclose (fp);
|
|
}
|
|
|
|
return tzbuf;
|
|
}
|
|
#else /* !USE_PAM */
|
|
extern int ISO_C_forbids_an_empty_translation_unit;
|
|
#endif /* !USE_PAM */
|
|
|