Bug 24695 - nss_db: calling getpwent after endpwent crashes
Summary: nss_db: calling getpwent after endpwent crashes
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: nss (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: 2.30
Assignee: dj@redhat.com
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-06-17 20:53 UTC by dj@redhat.com
Modified: 2019-10-31 23:16 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description dj@redhat.com 2019-06-17 20:53:21 UTC
If you omit the setpwent() call, getpwent() works correctly - until you call endpwent(), after which further calls to getpwent() segfault instead of restarting the scan.

Reproducible with "passwd: db ..." in /etc/nsswitch.conf
Comment 1 Sourceware Commits 2019-07-10 18:52:24 UTC
The master branch has been updated by DJ Delorie <dj@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=99135114ba23c3110b7e4e650fabdc5e639746b7

commit 99135114ba23c3110b7e4e650fabdc5e639746b7
Author: DJ Delorie <dj@redhat.com>
Date:   Fri Jun 28 18:30:00 2019 -0500

    nss_db: fix endent wrt NULL mappings [BZ #24695] [BZ #24696]
    
    nss_db allows for getpwent et al to be called without a set*ent,
    but it only works once.  After the last get*ent a set*ent is
    required to restart, because the end*ent did not properly reset
    the module.  Resetting it to NULL allows for a proper restart.
    
    If the database doesn't exist, however, end*ent erroniously called
    munmap which set errno.
    
    The test case runs "makedb" inside the testroot, so needs selinux
    DSOs installed.
Comment 2 dj@redhat.com 2019-07-10 18:56:00 UTC
Fix committed.
Comment 3 Sourceware Commits 2019-10-31 23:14:27 UTC
The release/2.28/master branch has been updated by DJ Delorie <dj@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=cef4c840a80372fe084effec0da1177d44b40bc0

commit cef4c840a80372fe084effec0da1177d44b40bc0
Author: DJ Delorie <dj@redhat.com>
Date:   Fri Jun 28 18:30:00 2019 -0500

    nss_db: fix endent wrt NULL mappings [BZ #24695] [BZ #24696]
    
    nss_db allows for getpwent et al to be called without a set*ent,
    but it only works once.  After the last get*ent a set*ent is
    required to restart, because the end*ent did not properly reset
    the module.  Resetting it to NULL allows for a proper restart.
    
    If the database doesn't exist, however, end*ent erroniously called
    munmap which set errno.
    
    The test case runs "makedb" inside the testroot, so needs selinux
    DSOs installed.
    
    (cherry picked from commit 99135114ba23c3110b7e4e650fabdc5e639746b7)
    (note: tests excluded as test-in-container infrastructure missing)
Comment 4 Sourceware Commits 2019-10-31 23:16:30 UTC
The release/2.29/master branch has been updated by DJ Delorie <dj@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=f1f24cdebafff0c372611801cc8dbe504c3ecfff

commit f1f24cdebafff0c372611801cc8dbe504c3ecfff
Author: DJ Delorie <dj@redhat.com>
Date:   Fri Jun 28 18:30:00 2019 -0500

    nss_db: fix endent wrt NULL mappings [BZ #24695] [BZ #24696]
    
    nss_db allows for getpwent et al to be called without a set*ent,
    but it only works once.  After the last get*ent a set*ent is
    required to restart, because the end*ent did not properly reset
    the module.  Resetting it to NULL allows for a proper restart.
    
    If the database doesn't exist, however, end*ent erroniously called
    munmap which set errno.
    
    The test case runs "makedb" inside the testroot, so needs selinux
    DSOs installed.
    
    (cherry picked from commit 99135114ba23c3110b7e4e650fabdc5e639746b7)