[patch] fix segfault when using 'userdel -r' and homedir is /dev/null
Mike Frysinger <[email protected]> Tue, 4 Jul 2006 15:45:24 -0400
| Newsgroups | gmane.linux.pld.shadow.general |
|---|---|
| Organization | wh0rd.org |
| Message-ID | <[email protected]> |
--Boundary-00=_UVsqE2XkRuj8MZ6
Content-Type: multipart/signed; boundary="nextPart21351810.v1goSR3Pan";
protocol="application/pgp-signature"; micalg=pgp-sha1
Content-Transfer-Encoding: 7bit
--nextPart21351810.v1goSR3Pan
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
when userdel is called with -r, the function remove_dir() is called on the=
=20
user's homedir ... well if the user's homedir is /dev/null, the code=20
segfaults
this is because remove_dir() calls opendir() on the homedir but never check=
s=20
the return value ... so it continues on to calling readdir(NULL) and then=20
promptly segfaults
patch attached to address the issue ... Gentoo bug report in case anyone ca=
res=20
is at http://bugs.gentoo.org/139148
=2Dmike
--nextPart21351810.v1goSR3Pan
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iQIVAwUARKrFVEFjO5/oN/WBAQJt/Q/+LHq0/8qcfnF7VlXNEXm/87sBPqoHqvqI
UkQFXIUQyPTBcZvOH7SMe/hP9DFyFSl10TRDvuiplE62BjCMtZP5ezlx3nNuku/5
XhB0lMnRO4nmYDtMgCwkxE8+SCpBIGQIONaz7f7y1JAZDeJkUOBp0pofGyR2ZhfY
ac6j7thHQN2zbtZ6nHB7dT6STM7oGQPIG0iQMHINeYHtDSXMG53BDfODEkJ7mcTC
RngSf2PBHm9X0o8rPoRbyjyMEjysTnlwQmnnGoEfw04iDzXKdyBNqrBeDbdl5COM
Wcx04S8dwe4bZLB/VOMjziTuJWgaujO6lsS6VbeE8Jn5O9Z+M44iApvwKgUBjgxr
R14LZV0G3d/WOl+ZRSSdIiA/88/2xwHPxE4080KvdqpZ8k7ttQX5NE6U/KpXydZ+
SeE4VknDL7HYGz43Yaq2ddfvDM+jVr/2Qgrlf6NXlPJKE3917Iwkbzbe7QIqJB05
JOGvpPyM9EW/P22h0EAHoxS+kLtwCG0VXccO8vYfChf+njDeo4CBeARxu55Fa2tR
HrsDvfKUnRTBeMbrvR87s5JLenEta/bgeVMcqPhkpRb2rmpmtfY0VUwyRJW8HBfU
r3OJLSp+/G7tiRf9MnGpVBwslZLxC4aWH2DGdPsy/04itjWntIWrc5SvmvQPS64V
lgTFiYTYJFw=
=8TDT
-----END PGP SIGNATURE-----
--nextPart21351810.v1goSR3Pan--
--Boundary-00=_UVsqE2XkRuj8MZ6
Content-Type: text/x-diff; charset="us-ascii";
name="shadow-check-opendir.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="shadow-check-opendir.patch"
Index: libmisc/copydir.c
===================================================================
RCS file: /cvsroot/shadow/libmisc/copydir.c,v
retrieving revision 1.14
diff -u -p -r1.14 copydir.c
--- libmisc/copydir.c 7 May 2006 18:10:10 -0000 1.14
+++ libmisc/copydir.c 4 Jul 2006 19:42:22 -0000
@@ -396,7 +396,8 @@ int remove_tree (const char *root)
* is made set-ID.
*/
- dir = opendir (root);
+ if (!(dir = opendir (root)))
+ return -1;
while ((ent = readdir (dir))) {
--Boundary-00=_UVsqE2XkRuj8MZ6
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline