[PATCH 0/4] Various nscd security fixes

[Florian Weimer <fweimer@redhat.com>]

Carlos filed bug 31677, and it it turns out that this is a reachable
stack-based buffer overflow.  The data looks quite attacker-controlled
to me and probably can contain NUL bytes with a custom client, so this
looks quite exploitable to my untrained eye.

Unfortunately, the reproducer kept crashing after the initial patch,
hence the second and third commit.  The two issues fixed in the last
commit were discovered by reading through the code.

By my count, this needs four different CVE identifiers:

  Bug 31677: the stack-based buffer overflow (commit 1)
  Bug 31678: two distinct null pointer dereferences (commit 2, commit 3)
    (same flaw type, presumably same version range, so MERGE from a
    CVE perspective)
  Bug 31679: process termination on malloc failure (commit 4)
  Byg 31680: memory corruption due to incorrect callback API assumption
    (commit 4)

Florian Weimer (4):
  nscd: Stack-based buffer overflow in netgroup cache (bug 31677)
  nscd: Do not send missing not-found response in addgetnetgrentX (bug
    31678)
  nscd: Avoid null pointer crashes after notfound response (bug 31678)
  nscd: netgroup: Use two buffers in addgetnetgrentX (bug 31680)

 nscd/netgroupcache.c | 247 +++++++++++++++++++++++--------------------
 1 file changed, 135 insertions(+), 112 deletions(-)


base-commit: f4724843ada64a51d66f65d3199fe431f9d4c254
-- 
2.44.0