Go to file
Tobias Stoeckmann 875d2d49c1 chfn: Prevent buffer overflow.
This is a stability fix, not a security fix, because the affected -o
option can only be used by root and it takes a modified passwd file.

If a gecos field for a user has BUFSIZ characters without commas and an
equals sign (i.e. a huge slop/extra field) and chfn is called with -o,
then a buffer overflow occurs.

It is not possible to trigger this with shadow tools. Therefore, the
passwd file must be modified manually.

I have fixed this unlikely case the easiest and cleanest way possible.
Since chfn bails out if more than 80 characters excluding commas are
supposed to be written into gecos field, we can stop processing early on
if -o argument is too long.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
2020-07-12 19:09:14 +02:00
contrib spelling: thanks 2017-10-22 21:24:49 +00:00
doc spelling: moment 2017-10-22 20:39:14 +00:00
docs github pages takes an index.html 2019-06-09 00:02:45 -05:00
etc Add "NONEXISTENT" to "etc/login.defs" 2020-05-11 09:26:04 -04:00
lib Merge pull request #234 from edneville/79_userdel 2020-06-10 00:31:10 -05:00
libmisc Merge pull request #244 from sthibaul/master 2020-04-23 10:56:48 -05:00
libsubid libsubid: fix a prototype in api.h 2020-06-19 22:09:20 -05:00
man Merge pull request #234 from edneville/79_userdel 2020-06-10 00:31:10 -05:00
po (nl) updated Dutch translation 2020-05-24 15:26:06 +02:00
src chfn: Prevent buffer overflow. 2020-07-12 19:09:14 +02:00
tests Create a new libsubid 2020-06-07 12:11:58 -05:00
.gitignore ignore config.cache & dist files 2016-12-05 15:48:10 -05:00
.travis.yml Create a new libsubid 2020-06-07 12:11:58 -05:00
acinclude.m4 [svn-upgrade] Integrating new upstream version, shadow (4.0.13) 2007-10-07 11:47:01 +00:00
autogen.sh Create a new libsubid 2020-06-07 12:11:58 -05:00
ChangeLog configure.ac: release 4.8.1 2020-01-23 14:56:43 -06:00
configure.ac Create a new libsubid 2020-06-07 12:11:58 -05:00
COPYING Added the subversion svn:keywords property (Id) for proper identification. 2007-11-10 23:46:11 +00:00
Makefile.am Create a new libsubid 2020-06-07 12:11:58 -05:00
NEWS spelling: various 2017-10-22 21:33:42 +00:00
README Update the "README" file 2020-05-11 09:27:01 -04:00
shadow.spec.in * shadow.spec.in: Fix the source (new FTP). 2008-08-31 17:30:45 +00:00
TODO New entry for vipw. 2012-01-15 21:26:56 +00:00

Shadow SITES
============

Homepage
	http://github.com/shadow-maint/shadow

Issue tracker
	http://github.com/shadow-maint/shadow/issues

Releases
	https://github.com/shadow-maint/shadow/releases

Mailing lists
	for general discuss: pkg-shadow-devel@alioth-lists.debian.net
	commit list: pkg-shadow-commits@alioth-lists.debian.net

Mailing lists subscription
	http://alioth-lists.debian.net/mailman/listinfo/pkg-shadow-devel
	http://alioth-lists.debian.net/mailman/listinfo/pkg-shadow-commits

Mailing lists archives:
	http://alioth-lists.debian.net/pipermail/pkg-shadow-devel/
	http://alioth-lists.debian.net/pipermail/pkg-shadow-commits/

S/Key support:
	Shadow can be built with S/Key support using the S/Key package from:

	http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libskey/
	or
	http://gentoo.osuosl.org/distfiles/skey-1.1.5.tar.bz2

Authors and contributors
========================

Thanks to at least the following people for sending patches, bug
reports and various comments.  This list may be incomplete, I received
a lot of mail...


Adam Rudnicki <adam@v-lo.krakow.pl>
Alan Curry <pacman@tardis.mars.net>
Aleksa Sarai <cyphar@cyphar.com>
Alexander O. Yuriev <alex@bach.cis.temple.edu>
Algis Rudys <arudys@rice.edu>
Andreas Jaeger <aj@arthur.rhein-neckar.de>
Aniello Del Sorbo <anidel@edu-gw.dia.unisa.it>
Anton Gluck <gluc@midway.uchicago.edu>
Arkadiusz Miskiewicz <misiek@pld.org.pl>
Ben Collins <bcollins@debian.org>
Brian R. Gaeke <brg@dgate.org>
Calle Karlsson <ckn@kash.se>
Chip Rosenthal <chip@unicom.com>
Chris Evans <lady0110@sable.ox.ac.uk>
Chris Lamb <chris@chris-lamb.co.uk>
Cristian Gafton <gafton@sorosis.ro>
Dan Walsh <dwalsh@redhat.com>
Darcy Boese <possum@chardonnay.niagara.com>
Dave Hagewood <admin@arrowweb.com>
David A. Holland <dholland@hcs.harvard.edu>
David Frey <David.Frey@lugs.ch>
Ed Carp <ecarp@netcom.com>
Ed Neville <ed@s5h.net>
Eric W. Biederman" <ebiederm@xmission.com>
Floody <flood@evcom.net>
Frank Denis <j@4u.net>
George Kraft IV <gk4@us.ibm.com>
Greg Mortensen <loki@world.std.com>
Guido van Rooij
Guy Maor <maor@debian.org>
Hrvoje Dogan <hdogan@bjesomar.srce.hr>
Jakub Hrozek <jhrozek@redhat.com>
Janos Farkas <chexum@bankinf.banki.hu>
Jason Franklin <jason.franklin@quoininc.com>
Jay Soffian <jay@lw.net>
Jesse Thilo <Jesse.Thilo@pobox.com>
Joey Hess <joey@kite.ml.org>
John Adelsberger <jja@umr.edu>
Jonathan Hankins <jhankins@mailserv.homewood.k12.al.us>
Jon Lewis <jlewis@lewis.org>
Joshua Cowan <jcowan@hermit.reslife.okstate.edu>
Judd Bourgeois <shagboy@bluesky.net>
Juergen Heinzl <unicorn@noris.net>
Juha Virtanen <jiivee@iki.fi>
Julian Pidancet <julian.pidancet@gmail.com>
Julianne Frances Haugh <jockgrrl@ix.netcom.com>
Leonard N. Zubkoff <lnz@dandelion.com>
Luca Berra <bluca@www.polimi.it>
Lukáš Kuklínek <lkukline@redhat.com>
Lutz Schwalowsky <schwalow@mineralogie.uni-hamburg.de>
Marc Ewing <marc@redhat.com>
Martin Bene <mb@sime.com>
Martin Mares <mj@gts.cz>
Michael Meskes <meskes@topsystem.de>
Michael Talbot-Wilson <mike@calypso.bns.com.au>
Michael Vetter <jubalh@iodoru.org>
Mike Frysinger <vapier@gentoo.org>
Mike Pakovic <mpakovic@users.southeast.net>
Nicolas François <nicolas.francois@centraliens.net>
Nikos Mavroyanopoulos <nmav@i-net.paiko.gr>
Pavel Machek <pavel@bug.ucw.cz>
Peter Vrabec <pvrabec@redhat.com>
Phillip Street
Rafał Maszkowski <rzm@icm.edu.pl>
Rani Chouha <ranibey@smartec.com>
Sami Kerola <kerolasa@rocketmail.com>
Scott Garman <scott.a.garman@intel.com>
Sebastian Rick Rijkers <srrijkers@gmail.com>
Seraphim Mellos <mellos@ceid.upatras.gr>
Shane Watts <shane@nexus.mlckew.edu.au>
Steve M. Robbins <steve@nyongwa.montreal.qc.ca>
Thorsten Kukuk <kukuk@suse.de>
Tim Hockin <thockin@eagle.ais.net>
Timo Karjalainen <timok@iki.fi>
Ulisses Alonso Camaro <ulisses@pusa.eleinf.uv.es>
Werner Fink <werner@suse.de>

Maintainers
===========

Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
Serge E. Hallyn <serge@hallyn.com> (2014-now)
Christian Brauner <christian@brauner.io> (2019-now)