mirror of
https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git
synced 2024-12-23 18:14:56 +01:00
3948edc24c
- Fix buffer overflow problem once and for all: do away with the buffer copies to 'user' prior to calling _scancaches() and just pass a pointer to the buffer returned by yp_match()/yp_first()/yp_next()/whatever. (We turn the first ':' to a NUL first so strcmp() works, then change it back later. Submitted by Bill Fenner <fenner@parc.xerox.com> and tweaked slightly by me. - Give _pw_breakout_yp() the 'more elegant solution' I promised way back when. Eliminate several copies to static buffers and replace them with just one copy. (The buffer returned by the NIS functions is at most YPMAXRECORD bytes long, so we should only need one static buffer of the same length (plus 2 for paranoia's sake).) - Also in _pw_breakout_yp(): always set pw.pw_passwd to the username obtained via NIS regardless of what pw_fields says: usernames cannot be overridden so we have no choice but to use the name returned by NIS. - _Again_ in _pw_breakout_yp(): before doing anything else, check that the first character of the NIS-returned buffer is not a '+' or '-'. If it is, drop the entry. (#define EXTRA_PARANOIA 1 :) - Probe for the master.passwd.* maps once during __initdb() instead of doing it each time _getyppass() or _nextyppass() is called. - Don't copy the NIS data buffers to static memory in _getyppass() and _nextyppass(): this is done in _pw_breakout_yp() now. - Test against phkmalloc and phkmalloc/2 (TNG!) to make sure we're free()ing the yp buffers sanely. - Put _havemaster(), _getyppass() and nextyppass() prototypes under #ifdef YP. (Somehow they ended up on the wrong side of the #endif.) - Remove unused variable ___yp_only. |
||
---|---|---|
.. | ||
csu/i386 | ||
libc | ||
libcom_err | ||
libcompat | ||
libcrypt | ||
libcurses | ||
libdisk | ||
libedit | ||
libf2c | ||
libF77 | ||
libforms | ||
libftp | ||
libI77 | ||
libkvm | ||
libm | ||
libmd | ||
libmytinfo | ||
libncurses | ||
libpam/modules | ||
libpcap | ||
libresolv | ||
librpc | ||
librpcsvc | ||
libscsi | ||
libskey | ||
libss | ||
libtelnet | ||
libterm | ||
libtermcap | ||
libutil | ||
liby | ||
msun | ||
ncurses/ncurses | ||
rpcsvc | ||
Makefile | ||
Makefile.inc |