diff options
| author | Ulrich Drepper <drepper@redhat.com> | 2010-02-03 06:23:31 -0800 |
|---|---|---|
| committer | Petr Baudis <pasky@ucw.cz> | 2010-05-12 01:41:59 +0200 |
| commit | b204d65517276f8cdaf3a83349d0f1f553da68a2 (patch) | |
| tree | 615653306b1e0204bff4fb4f5575272ab511651f | |
| parent | 272eb2b141c22d03c1c68050b4ad97b2a0adfc69 (diff) | |
Fix endless loop with invalid /etc/shells file.
(cherry picked from commit caa6e77293d85e31dfde371b78862e9330a1478e)
| -rw-r--r-- | ChangeLog | 6 | ||||
| -rw-r--r-- | misc/getusershell.c | 4 |
2 files changed, 8 insertions, 2 deletions
@@ -1,3 +1,9 @@ +2010-02-03 Ulrich Drepper <drepper@redhat.com> + + [BZ #11242] + * misc/getusershell.c (initshells): Allocate one more byte in input + buffer so that fgets doesn't loop undefinitely. + 2010-01-25 Andreas Schwab <schwab@redhat.com> * iconv/iconv_prog.c (write_output): Fix check for open failure. diff --git a/misc/getusershell.c b/misc/getusershell.c index 636da322f9..0e4f79619f 100644 --- a/misc/getusershell.c +++ b/misc/getusershell.c @@ -116,7 +116,8 @@ initshells() } if (statb.st_size > ~(size_t)0 / sizeof (char *) * 3) goto init_okshells; - if ((strings = malloc(statb.st_size + 2)) == NULL) + flen = statb.st_size + 3; + if ((strings = malloc(flen)) == NULL) goto init_okshells; shells = malloc(statb.st_size / 3 * sizeof (char *)); if (shells == NULL) { @@ -126,7 +127,6 @@ initshells() } sp = shells; cp = strings; - flen = statb.st_size + 2; while (fgets_unlocked(cp, flen - (cp - strings), fp) != NULL) { while (*cp != '#' && *cp != '/' && *cp != '\0') cp++; |