glibc/nss/bug17079.c

243 lines
7.1 KiB
C

/* Test for bug 17079: heap overflow in NSS with small buffers.
Copyright (C) 2015-2018 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<http://www.gnu.org/licenses/>. */
#include <errno.h>
#include <nss.h>
#include <pwd.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <support/support.h>
/* Check if two passwd structs contain the same data. */
static bool
equal (const struct passwd *a, const struct passwd *b)
{
return strcmp (a->pw_name, b->pw_name) == 0
&& strcmp (a->pw_passwd, b->pw_passwd) == 0
&& a->pw_uid == b->pw_uid
&& a->pw_gid == b->pw_gid
&& strcmp (a->pw_gecos, b->pw_gecos) == 0
&& strcmp (a->pw_dir, b->pw_dir) == 0
&& strcmp (a->pw_shell, b->pw_shell) == 0;
}
enum { MAX_TEST_ITEMS = 10 };
static struct passwd test_items[MAX_TEST_ITEMS];
static int test_count;
/* Initialize test_items and test_count above, with data from the
passwd database. */
static bool
init_test_items (void)
{
setpwent ();
do
{
struct passwd *pwd = getpwent ();
if (pwd == NULL)
break;
struct passwd *target = test_items + test_count;
target->pw_name = xstrdup (pwd->pw_name);
target->pw_passwd = xstrdup (pwd->pw_passwd);
target->pw_uid = pwd->pw_uid;
target->pw_gid = pwd->pw_gid;
target->pw_gecos = xstrdup (pwd->pw_gecos);
target->pw_dir = xstrdup (pwd->pw_dir);
target->pw_shell = xstrdup (pwd->pw_shell);
}
while (++test_count < MAX_TEST_ITEMS);
endpwent ();
/* Filter out those test items which cannot be looked up by name or
UID. */
bool found = false;
for (int i = 0; i < test_count; ++i)
{
struct passwd *pwd1 = getpwnam (test_items[i].pw_name);
struct passwd *pwd2 = getpwuid (test_items[i].pw_uid);
if (pwd1 == NULL || !equal (pwd1, test_items + i)
|| pwd2 == NULL || !equal (pwd2, test_items + i))
{
printf ("info: skipping user \"%s\", UID %ld due to inconsistency\n",
test_items[i].pw_name, (long) test_items[i].pw_uid);
test_items[i].pw_name = NULL;
}
else
found = true;
}
if (!found)
puts ("error: no accounts found which can be looked up by name and UID.");
return found;
}
/* Set to true if an error is encountered. */
static bool errors;
/* Return true if the padding has not been tampered with. */
static bool
check_padding (char *buffer, size_t size, char pad)
{
char *end = buffer + size;
while (buffer < end)
{
if (*buffer != pad)
return false;
++buffer;
}
return true;
}
/* Test one buffer size and padding combination. */
static void
test_one (const struct passwd *item, size_t buffer_size,
char pad, size_t padding_size)
{
char *buffer = xmalloc (buffer_size + padding_size);
struct passwd pwd;
struct passwd *result;
int ret;
/* Test getpwname_r. */
memset (buffer, pad, buffer_size + padding_size);
pwd = (struct passwd) {};
ret = getpwnam_r (item->pw_name, &pwd, buffer, buffer_size, &result);
if (!check_padding (buffer + buffer_size, padding_size, pad))
{
printf ("error: padding change: "
"name \"%s\", buffer size %zu, padding size %zu, pad 0x%02x\n",
item->pw_name, buffer_size, padding_size, (unsigned char) pad);
errors = true;
}
if (ret == 0)
{
if (result == NULL)
{
printf ("error: no data: name \"%s\", buffer size %zu\n",
item->pw_name, buffer_size);
errors = true;
}
else if (!equal (item, result))
{
printf ("error: lookup mismatch: name \"%s\", buffer size %zu\n",
item->pw_name, buffer_size);
errors = true;
}
}
else if (ret != ERANGE)
{
errno = ret;
printf ("error: lookup failure for name \"%s\": %m (%d)\n",
item->pw_name, ret);
errors = true;
}
/* Test getpwuid_r. */
memset (buffer, pad, buffer_size + padding_size);
pwd = (struct passwd) {};
ret = getpwuid_r (item->pw_uid, &pwd, buffer, buffer_size, &result);
if (!check_padding (buffer + buffer_size, padding_size, pad))
{
printf ("error: padding change: "
"UID %ld, buffer size %zu, padding size %zu, pad 0x%02x\n",
(long) item->pw_uid, buffer_size, padding_size,
(unsigned char) pad);
errors = true;
}
if (ret == 0)
{
if (result == NULL)
{
printf ("error: no data: UID %ld, buffer size %zu\n",
(long) item->pw_uid, buffer_size);
errors = true;
}
else if (!equal (item, result))
{
printf ("error: lookup mismatch: UID %ld, buffer size %zu\n",
(long) item->pw_uid, buffer_size);
errors = true;
}
}
else if (ret != ERANGE)
{
errno = ret;
printf ("error: lookup failure for UID \"%ld\": %m (%d)\n",
(long) item->pw_uid, ret);
errors = true;
}
free (buffer);
}
/* Test one buffer size with different paddings. */
static void
test_buffer_size (size_t buffer_size)
{
for (int i = 0; i < test_count; ++i)
for (size_t padding_size = 0; padding_size < 3; ++padding_size)
{
/* Skip entries with inconsistent name/UID lookups. */
if (test_items[i].pw_name == NULL)
continue;
test_one (test_items + i, buffer_size, '\0', padding_size);
if (padding_size > 0)
{
test_one (test_items + i, buffer_size, ':', padding_size);
test_one (test_items + i, buffer_size, '\n', padding_size);
test_one (test_items + i, buffer_size, '\xff', padding_size);
test_one (test_items + i, buffer_size, '@', padding_size);
}
}
}
int
do_test (void)
{
__nss_configure_lookup ("passwd", "files");
if (!init_test_items ())
return 1;
printf ("info: %d test items\n", test_count);
for (size_t buffer_size = 0; buffer_size <= 65; ++buffer_size)
test_buffer_size (buffer_size);
for (size_t buffer_size = 64 + 4; buffer_size < 256; buffer_size += 4)
test_buffer_size (buffer_size);
test_buffer_size (255);
test_buffer_size (257);
for (size_t buffer_size = 256; buffer_size < 512; buffer_size += 8)
test_buffer_size (buffer_size);
test_buffer_size (511);
test_buffer_size (513);
test_buffer_size (1024);
test_buffer_size (2048);
if (errors)
return 1;
else
return 0;
}
#include <support/test-driver.c>