提交 4b5ca13f 编写于 作者: R Rich Felker

avoid sending huge names as nscd passwd/group queries

overly long user/group names are potentially a DoS vector and source
of other problems like partial writes by sendmsg, and not useful.
上级 49d1e7f9
......@@ -4,6 +4,7 @@
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <limits.h>
#include "nscd.h"
static const struct {
......@@ -22,7 +23,7 @@ FILE *__nscd_query(int32_t req, const char *key, int32_t *buf, size_t len, int *
int32_t req_buf[REQ_LEN] = {
NSCDVERSION,
req,
strlen(key)+1
strnlen(key,LOGIN_NAME_MAX)+1
};
struct msghdr msg = {
.msg_iov = (struct iovec[]){
......@@ -45,7 +46,7 @@ retry:
return 0;
}
if (strlen(key) > INT32_MAX - 1)
if (req_buf[2] > LOGIN_NAME_MAX)
return f;
if (connect(fd, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册