nss_files: Fix /etc/aliases null pointer dereference [BZ #24059]

If /etc/aliases ends with a continuation line (a line that starts
with whitespace) which does not have a trailing newline character,
the file parser would crash due to a null pointer dereference.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>

diff --git a/ChangeLog b/ChangeLog
index 32579d7d0bed7a09083aa1e54b9c971c8582a32a..05e13e65f02542813b275181a856178511d3e3b9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,19 @@
+2019-01-31  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #24059]
+       * nss/nss_files/files-alias.c (get_next_alias): Handle
+       continuation line without newline at the end.
+       * nss/tst-nss-files-alias-truncated.c: New file.
+       * nss/Makefile [$(build-shared)] (tests): Add
+       tst-nss-files-alias-truncated.
+       (tst-nss-files-alias-truncated): Link with libnss_files.so.
+       * support/namespace.h (struct support_chroot_configuration): Add
+       aliases member.
+       (struct support_chroot): Add path_aliases member.
+       * support/support_chroot.c (support_chroot_create): Handle
+       aliases.
+       (support_chroot_free): Free path_aliases.
+
 2019-01-31  Siddhesh Poyarekar  <siddhesh@sourceware.org>
 
        * version.h (RELEASE): Set to "development".

diff --git a/nss/Makefile b/nss/Makefile
index 0fa28f0c5e18b026ff8018f7c593ce965001057c..e66e01d45a8200e616f4ad84ab35e2c70a106f58 100644 (file)
--- a/nss/Makefile
+++ b/nss/Makefile
@@ -68,6 +68,7 @@ tests += tst-nss-files-hosts-erange
 tests += tst-nss-files-hosts-multi
 tests += tst-nss-files-hosts-getent
 tests += tst-nss-files-alias-leak
+tests += tst-nss-files-alias-truncated
 endif
 
 # If we have a thread library then we can test cancellation against
@@ -176,3 +177,4 @@ $(objpfx)tst-nss-files-hosts-multi: $(libdl)
 $(objpfx)tst-nss-files-hosts-getent: $(libdl)
 $(objpfx)tst-nss-files-alias-leak: $(libdl)
 $(objpfx)tst-nss-files-alias-leak.out: $(objpfx)/libnss_files.so
+$(objpfx)tst-nss-files-alias-truncated: $(objpfx)/libnss_files.so

diff --git a/nss/nss_files/files-alias.c b/nss/nss_files/files-alias.c
index 540eb9c678ba90e58f5f6be45a45722b858c867d..34d7aa84cc632428ddaa11fa18bca049d28dbfd6 100644 (file)
--- a/nss/nss_files/files-alias.c
+++ b/nss/nss_files/files-alias.c
@@ -333,6 +333,16 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
                     can be ignored.  */
                  first_unused[room_left - 1] = '\xff';
                  line = fgets_unlocked (first_unused, room_left, stream);
+                 if (line == NULL)
+                   {
+                     /* Continuation line without any data and
+                        without a newline at the end.  Treat it as an
+                        empty line and retry, reaching EOF once
+                        more.  */
+                     line = first_unused;
+                     *line = '\0';
+                     continue;
+                   }
                  if (first_unused[room_left - 1] != '\xff')
                    goto no_more_room;
                  cp = strpbrk (line, "#\n");

diff --git a/nss/tst-nss-files-alias-truncated.c b/nss/tst-nss-files-alias-truncated.c
new file mode 100644 (file)
index 0000000..2d6aba3
--- /dev/null
+++ b/nss/tst-nss-files-alias-truncated.c
@@ -0,0 +1,66 @@
+/* Check handling of missing end-of-line at end of /etc/aliases (bug 24059).
+   Copyright (C) 2019 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <aliases.h>
+#include <nss.h>
+#include <stddef.h>
+#include <support/check.h>
+#include <support/namespace.h>
+#include <support/test-driver.h>
+#include <support/xunistd.h>
+
+static void
+in_chroot (void *closure)
+{
+  struct support_chroot *chroot_env = closure;
+  xchroot (chroot_env->path_chroot);
+
+  struct aliasent *e = getaliasbyname ("user1");
+  TEST_VERIFY_EXIT (e != NULL);
+  TEST_COMPARE_STRING (e->alias_name, "user1");
+  TEST_COMPARE (e->alias_members_len, 1);
+  TEST_VERIFY_EXIT (e->alias_members != NULL);
+  TEST_COMPARE_STRING (e->alias_members[0], "alias1");
+  TEST_VERIFY (e->alias_local);
+}
+
+static int
+do_test (void)
+{
+  /* nss_files has already been loaded via DT_NEEDED, outside the
+     chroot.  */
+  __nss_configure_lookup ("aliases", "files");
+
+  support_become_root ();
+  if (!support_can_chroot ())
+    return EXIT_UNSUPPORTED;
+
+  struct support_chroot *chroot_env = support_chroot_create
+    ((struct support_chroot_configuration)
+     {
+       .aliases = "user1: alias1,\n"
+        " "              /* Continuation line, but no \n.  */
+     });
+
+  support_isolate_in_subprocess (in_chroot, chroot_env);
+
+  support_chroot_free (chroot_env);
+  return 0;
+}
+
+#include <support/test-driver.c>

diff --git a/support/namespace.h b/support/namespace.h
index f93754934f0d607f7133d93faed57aa66abbe310..4770cf9e9065ec14aa68cabc39a995b318b74cfd 100644 (file)
--- a/support/namespace.h
+++ b/support/namespace.h
@@ -74,6 +74,7 @@ struct support_chroot_configuration
   const char *resolv_conf;      /* /etc/resolv.conf.  */
   const char *hosts;            /* /etc/hosts.  */
   const char *host_conf;        /* /etc/host.conf.  */
+  const char *aliases;          /* /etc/aliases.  */
 };
 
 /* The result of the creation of a chroot.  */
@@ -90,6 +91,7 @@ struct support_chroot
   char *path_resolv_conf;       /* /etc/resolv.conf.  */
   char *path_hosts;             /* /etc/hosts.  */
   char *path_host_conf;         /* /etc/host.conf.  */
+  char *path_aliases;           /* /etc/aliases.  */
 };
 
 /* Create a chroot environment.  The returned data should be freed

diff --git a/support/support_chroot.c b/support/support_chroot.c
index b866b89a1855424d072bf95eab26b7816ddd9086..412ec33f53b85eab191a6c29ac923ba8a0157653 100644 (file)
--- a/support/support_chroot.c
+++ b/support/support_chroot.c
@@ -56,6 +56,7 @@ support_chroot_create (struct support_chroot_configuration conf)
               &chroot->path_resolv_conf);
   write_file (path_etc, "hosts", conf.hosts, &chroot->path_hosts);
   write_file (path_etc, "host.conf", conf.host_conf, &chroot->path_host_conf);
+  write_file (path_etc, "aliases", conf.aliases, &chroot->path_aliases);
 
   free (path_etc);
 
@@ -77,5 +78,6 @@ support_chroot_free (struct support_chroot *chroot)
   free (chroot->path_resolv_conf);
   free (chroot->path_hosts);
   free (chroot->path_host_conf);
+  free (chroot->path_aliases);
   free (chroot);
 }