From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS17314 8.43.84.0/22 X-Spam-Status: No, score=-4.5 required=3.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI,NICE_REPLY_A, RCVD_IN_DNSWL_HI,SPF_HELO_PASS,SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by dcvr.yhbt.net (Postfix) with ESMTPS id 9E1491F8C6 for ; Sun, 11 Jul 2021 14:59:04 +0000 (UTC) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 8B8C73854833 for ; Sun, 11 Jul 2021 14:59:03 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 8B8C73854833 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1626015543; bh=HinsF+Om3aqT5eeXCOCWHz0t97sRQo8/+G3ShFgiQSg=; h=Subject:To:References:Date:In-Reply-To:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=sEebXvo1Nm/pShR0erekOX6X/Rbr/l9LXSwwz9nwoCO7ggQgLtRB2+47l6Xuepodf Stxv2skcFiP2MEc4zNJh7NOVzUbzD4U7+Mo6tnHKZwSSknWF5AGsFU7V4P94zvLVMd 79GtKnvVbcXR3mlXKKSR1ZVzRgMjZXY039UKsPN4= Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by sourceware.org (Postfix) with ESMTP id BFFF63854833 for ; Sun, 11 Jul 2021 14:58:43 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org BFFF63854833 Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-199-eDWV3bvSNlm0GvLsFB_O7A-1; Sun, 11 Jul 2021 10:58:42 -0400 X-MC-Unique: eDWV3bvSNlm0GvLsFB_O7A-1 Received: by mail-qv1-f70.google.com with SMTP id y35-20020a0cb8a30000b0290270c2da88e8so11760215qvf.13 for ; Sun, 11 Jul 2021 07:58:42 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=HinsF+Om3aqT5eeXCOCWHz0t97sRQo8/+G3ShFgiQSg=; b=APiWFPLOAZywV8/7uXAiiFtyGnkAXlgYHRNLQHRyzOQf445Y4DYsEgvewjWrurT8Cj nAA2gKhRxlMonfYFZ1Y/glIGaXJCZb535DhG7jTd+92yy0SbVATdR0kCH+P/nBAnpY9U ams3YjaZPu6jP8yBJORE+jg1pmnY+oFArB56QS4er1gWoWRQHLzS0ywd5oBQLNmBs+yz 9ONzlJrdV6SxERBm/aTb4L5CoxXtN6s0FF1gefyTFN8kSB/lpN7L2r/Ru/9b7xBYJiu5 3EIkGIEjoCW1WOul8Dyq86swlZoG+/P1D7trsZXe5CY6RwuvEfwaxlvdZcrgNgnC5XXr 5Amg== X-Gm-Message-State: AOAM530S2h5Tl9q3Vu8fNIKXt0YvMpdJ2LWi+WGEKRoyoTAETOfn/McN y0IM21Vm97RUOc+KRr4PoPR6v9xISU7EEqCU666j42ChcDLwF7K8uAuSKIT3a7RDfZmsdGgWIRQ j0CqDFOlNI5nOJZ2UMWAP0l/fIIY0scP7BcwN/ewDoic00t4/mRU6XIkwWARXuh50iEVnUw== X-Received: by 2002:a37:7e46:: with SMTP id z67mr13496745qkc.417.1626015521849; Sun, 11 Jul 2021 07:58:41 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyy4vdZLC3GYzMy2peGowlVnyUEQQuPRedWtkPWWYOjCiDOtzO3uo5mvD2267+bTNhhJmvU8A== X-Received: by 2002:a37:7e46:: with SMTP id z67mr13496727qkc.417.1626015521651; Sun, 11 Jul 2021 07:58:41 -0700 (PDT) Received: from [192.168.1.16] (198-84-214-74.cpe.teksavvy.com. [198.84.214.74]) by smtp.gmail.com with ESMTPSA id j28sm4971823qki.52.2021.07.11.07.58.40 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 11 Jul 2021 07:58:41 -0700 (PDT) Subject: Re: [PATCH] nis: nis_local_group may read from __nisgroup[-1] (bug 28075) To: Florian Weimer , libc-alpha@sourceware.org References: <87tul0ex4t.fsf@oldenburg.str.redhat.com> Organization: Red Hat Message-ID: <87c6b7a6-85ea-1c1d-9181-7619bdd3a0f9@redhat.com> Date: Sun, 11 Jul 2021 10:58:40 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <87tul0ex4t.fsf@oldenburg.str.redhat.com> X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Carlos O'Donell via Libc-alpha Reply-To: Carlos O'Donell Errors-To: libc-alpha-bounces+e=80x24.org@sourceware.org Sender: "Libc-alpha" On 7/11/21 10:35 AM, Florian Weimer via Libc-alpha wrote: > Tested on i686-linux-gnu and x86_64-linux-gnu. In nis/* there are 6 uses of getenv. The other users: __nis_default_owner, __nis_default_group, __nis_default_ttl, __nis_default_access, all use strstr to determine the position of parameters and don't suffer the same problem (empty env var), likewise nis_getnames but with __srtok_r. The code you are fixing doesn't appear to consider an empty env var. I also looked up the call chain to see if nis_clone_object inspected the group to see if it was empty and it does, and so it appears safe. LGTM. Reviewed-by: Carlos O'Donell > --- > nis/nis_local_names.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/nis/nis_local_names.c b/nis/nis_local_names.c > index 080dcf88bd..218764f32e 100644 > --- a/nis/nis_local_names.c > +++ b/nis/nis_local_names.c > @@ -31,6 +31,7 @@ nis_local_group (void) > char *cptr; > if (__nisgroup[0] == '\0' > && (cptr = getenv ("NIS_GROUP")) != NULL > + && cptr[0] != '\0' > && strlen (cptr) < NIS_MAXNAMELEN) > { > char *cp = stpcpy (__nisgroup, cptr); > -- Cheers, Carlos.