hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-12-18 05:53:36 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Handle overflow of uid or gid in arguments for chown

Browse Source 
chown incorrectly allows a uid or gid greater than UID_MAX/GID_MAX respectively.
Using such an argument rolls over to accounts such as root, operator, etc.

Approved by:	re (gjb)
Relnotes:	yes
Reviewed by:	cem, kib
Submitted by:	Don Morris <dgmorris@earthlink.net>
Sponsored by:	Dell EMC
Differential Revision:	https://reviews.freebsd.org/D15119
This commit is contained in:
Bryan Drewery 2018-09-26 18:40:57 +00:00
parent 0dc34160f3
commit d51abd5fe1
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=338950
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
usr.sbin/chown/chown.c
View File

@ -55,6 +55,7 @@ __FBSDID("$FreeBSD$");
#include <libgen.h>
#include <pwd.h>
#include <signal.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
@ -246,16 +247,13 @@ a_uid(const char *s)
static uid_t
id(const char *name, const char *type)
{
uid_t val;
unsigned long val;
char *ep;
/*
* XXX
* We know that uid_t's and gid_t's are unsigned longs.
*/
errno = 0;
val = strtoul(name, &ep, 10);
if (errno || *ep != '\0')
_Static_assert(UID_MAX >= GID_MAX, "UID MAX less than GID MAX");
if (errno || *ep != '\0' || val > UID_MAX)
errx(1, "%s: illegal %s name", name, type);
return (val);
}