[Bug nis/20987] New: NIS+ unbounded stack allocations

[jsm28 at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=20987

            Bug ID: 20987
           Summary: NIS+ unbounded stack allocations
           Product: glibc
           Version: 2.24
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nis
          Assignee: unassigned at sourceware dot org
          Reporter: jsm28 at gcc dot gnu.org
                CC: kukuk at suse dot de
  Target Milestone: ---

The nss_nisplus code contains various VLAs with a size based on the length of a
string passed in, and nothing obvious to bound that length.

Specifically, this bug is about the following VLAs in nss_nisplus (there are
others as well which may or may not have bounded lengths):

nisplus-alias.c:  char buf[strlen (name) + 9 + tablename_len];
nisplus-ethers.c:  char buf[strlen (name) + 9 + tablename_len];
nisplus-grp.c:  char buf[strlen (name) + 9 + grp_tablename_len];
nisplus-hosts.c:  char buf[strlen (name) + 10 + tablename_len];
nisplus-initgroups.c:  char buf[strlen (user) + 12 + grp_tablename_len];
nisplus-netgrp.c:  char buf[strlen (group) + 25];
nisplus-network.c:  char buf[strlen (name) + 10 + tablename_len];
nisplus-proto.c:  char buf[strlen (name) + 10 + tablename_len];
nisplus-pwd.c:  char buf[strlen (name) + 9 + pwd_tablename_len];
nisplus-rpc.c:  char buf[strlen (name) + 10 + tablename_len];
nisplus-service.c:  char buf[17 + 3 * sizeof (int) + strlen (protocol) +
tablename_len];
nisplus-spwd.c:  char buf[strlen (name) + 9 + pwd_tablename_len];

(another instance in nisplus-service.c is bug 17913) and also for

nis_table.c:  char *cptr = strdupa (name);

in __create_ib_request, called from nis_list which is both a public interface
in libnsl (I don't know if it's relevant for NIS or only for NIS+) as well as
being called with the strings constructed in the VLA buffers above.

I have not ascertained whether all the above (or the case in bug 17913) are in
fact reachable with strings of unbounded length, or whether such strings might
cross a privilege boundary and so render this a security issue.

-- 
You are receiving this mail because:
You are on the CC list for the bug.