526d85831
Denys Vlasenko
2015-10-19
Subject
libbb: get_uidgid() always called with allow_numeric=1
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
include/libbb.h+3 -4
| @@ -920,14 +920,13 @@ long xuname2uid(const char *name) FAST_FUNC; | |
| long xgroup2gid(const char *name) FAST_FUNC; | |
| /* wrapper: allows string to contain numeric uid or gid */ | |
| unsigned long get_ug_id(const char *s, long FAST_FUNC (*xname2id)(const char *)) FAST_FUNC; | |
| - | /* from chpst. Does not die, returns 0 on failure */ |
| struct bb_uidgid_t { | |
| uid_t uid; | |
| gid_t gid; | |
| }; | |
| - | /* always sets uid and gid */ |
| - | int get_uidgid(struct bb_uidgid_t*, const char*, int numeric_ok) FAST_FUNC; |
| - | /* always sets uid and gid, allows numeric; exits on failure */ |
| + | /* always sets uid and gid; returns 0 on failure */ |
| + | int get_uidgid(struct bb_uidgid_t*, const char*) FAST_FUNC; |
| + | /* always sets uid and gid; exits on failure */ |
| void xget_uidgid(struct bb_uidgid_t*, const char*) FAST_FUNC; | |
| /* chown-like handling of "user[:[group]" */ | |
| void parse_chown_usergroup_or_die(struct bb_uidgid_t *u, char *user_group) FAST_FUNC; | |
libbb/appletlib.c+1 -1
| @@ -437,7 +437,7 @@ static void parse_config_file(void) | |
| goto pe_label; | |
| } | |
| *e = ':'; /* get_uidgid needs USER:GROUP syntax */ | |
| - | if (get_uidgid(&sct->m_ugid, s, /*allow_numeric:*/ 1) == 0) { |
| + | if (get_uidgid(&sct->m_ugid, s) == 0) { |
| errmsg = "unknown user/group"; | |
| goto pe_label; | |
| } | |
libpwdgrp/uidgid_get.c+19 -23
| @@ -28,7 +28,7 @@ ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
| #include "libbb.h" | |
| /* Always sets uid and gid */ | |
| - | int FAST_FUNC get_uidgid(struct bb_uidgid_t *u, const char *ug, int numeric_ok) |
| + | int FAST_FUNC get_uidgid(struct bb_uidgid_t *u, const char *ug) |
| { | |
| struct passwd *pwd; | |
| struct group *gr; | |
| @@ -43,18 +43,16 @@ int FAST_FUNC get_uidgid(struct bb_uidgid_t *u, const char *ug, int numeric_ok) | |
| /* copies sz-1 bytes, stores terminating '\0' */ | |
| safe_strncpy(user, ug, sz); | |
| } | |
| - | if (numeric_ok) { |
| - | n = bb_strtou(user, NULL, 10); |
| - | if (!errno) { |
| - | u->uid = n; |
| - | pwd = getpwuid(n); |
| - | /* If we have e.g. "500" string without user */ |
| - | /* with uid 500 in /etc/passwd, we set gid == uid */ |
| - | u->gid = pwd ? pwd->pw_gid : n; |
| - | goto skip; |
| - | } |
| + | n = bb_strtou(user, NULL, 10); |
| + | if (!errno) { |
| + | u->uid = n; |
| + | pwd = getpwuid(n); |
| + | /* If we have e.g. "500" string without user */ |
| + | /* with uid 500 in /etc/passwd, we set gid == uid */ |
| + | u->gid = pwd ? pwd->pw_gid : n; |
| + | goto skip; |
| } | |
| - | /* Either it is not numeric, or caller disallows numeric username */ |
| + | /* it is not numeric */ |
| pwd = getpwnam(user); | |
| if (!pwd) | |
| return 0; | |
| @@ -63,12 +61,10 @@ int FAST_FUNC get_uidgid(struct bb_uidgid_t *u, const char *ug, int numeric_ok) | |
| skip: | |
| if (group) { | |
| - | if (numeric_ok) { |
| - | n = bb_strtou(group, NULL, 10); |
| - | if (!errno) { |
| - | u->gid = n; |
| - | return 1; |
| - | } |
| + | n = bb_strtou(group, NULL, 10); |
| + | if (!errno) { |
| + | u->gid = n; |
| + | return 1; |
| } | |
| gr = getgrnam(group); | |
| if (!gr) | |
| @@ -79,7 +75,7 @@ int FAST_FUNC get_uidgid(struct bb_uidgid_t *u, const char *ug, int numeric_ok) | |
| } | |
| void FAST_FUNC xget_uidgid(struct bb_uidgid_t *u, const char *ug) | |
| { | |
| - | if (!get_uidgid(u, ug, 1)) |
| + | if (!get_uidgid(u, ug)) |
| bb_error_msg_and_die("unknown user/group %s", ug); | |
| } | |
| @@ -119,16 +115,16 @@ int main() | |
| { | |
| unsigned u; | |
| struct bb_uidgid_t ug; | |
| - | u = get_uidgid(&ug, "apache", 0); |
| + | u = get_uidgid(&ug, "apache"); |
| printf("%u = %u:%u\n", u, ug.uid, ug.gid); | |
| ug.uid = ug.gid = 1111; | |
| - | u = get_uidgid(&ug, "apache", 0); |
| + | u = get_uidgid(&ug, "apache"); |
| printf("%u = %u:%u\n", u, ug.uid, ug.gid); | |
| ug.uid = ug.gid = 1111; | |
| - | u = get_uidgid(&ug, "apache:users", 0); |
| + | u = get_uidgid(&ug, "apache:users"); |
| printf("%u = %u:%u\n", u, ug.uid, ug.gid); | |
| ug.uid = ug.gid = 1111; | |
| - | u = get_uidgid(&ug, "apache:users", 0); |
| + | u = get_uidgid(&ug, "apache:users"); |
| printf("%u = %u:%u\n", u, ug.uid, ug.gid); | |
| return 0; | |
| } | |
util-linux/mdev.c+1 -1
| @@ -400,7 +400,7 @@ static void parse_next_rule(void) | |
| } | |
| /* 2nd field: uid:gid - device ownership */ | |
| - | if (get_uidgid(&G.cur_rule.ugid, tokens[1], /*allow_numeric:*/ 1) == 0) { |
| + | if (get_uidgid(&G.cur_rule.ugid, tokens[1]) == 0) { |
| bb_error_msg("unknown user/group '%s' on line %d", tokens[1], G.parser->lineno); | |
| goto next_rule; | |
| } | |