[Bug nss/24059] New: nss_files: get_next_alias calls fgets_unlocked without checking for NULL.

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=24059

            Bug ID: 24059
           Summary: nss_files: get_next_alias calls fgets_unlocked without
                    checking for NULL.
           Product: glibc
           Version: 2.30
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nss
          Assignee: unassigned at sourceware dot org
          Reporter: carlos at redhat dot com
  Target Milestone: ---

The nss_files service calls fgets_unlocked() and does not check for NULL return
like the other two calls in the function.

nss/nss_files/files-alias.c (get_next_alias):

183           while (! ignore)
184             {
185               while (isspace (*line))
186                 ++line;

...

332                   /* The just read character is a white space and so
333                      can be ignored.  */
334                   first_unused[room_left - 1] = '\xff';
335                   line = fgets_unlocked (first_unused, room_left, stream);
336                   if (first_unused[room_left - 1] != '\xff')
337                     goto no_more_room;
338                   cp = strpbrk (line, "#\n");
339                   if (cp != NULL)
340                     *cp = '\0';

It looks like we should skip this line to avoid a null dereference on line 185.

diff --git a/nss/nss_files/files-alias.c b/nss/nss_files/files-alias.c
index 540eb9c678..8fb185fca0 100644
--- a/nss/nss_files/files-alias.c
+++ b/nss/nss_files/files-alias.c
@@ -333,6 +333,8 @@ get_next_alias (FILE *stream, const char *match, struct
aliasent *result,
                     can be ignored.  */
                  first_unused[room_left - 1] = '\xff';
                  line = fgets_unlocked (first_unused, room_left, stream);
+                 if (line == NULL)
+                   break;
                  if (first_unused[room_left - 1] != '\xff')
                    goto no_more_room;
                  cp = strpbrk (line, "#\n");
---

This needs a test case.

-- 
You are receiving this mail because:
You are on the CC list for the bug.