Re: useradd segfaults

This is not my patch but it has just appeared on RedHat Bugzilla:
https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=111425&action=view

I have not tested it yet either.  Looks more or less like my patch 
(which I have left at home).

John.


--- shadow-4.0.3/lib/gshadow.c.maxmem	1998-04-02 23:51:43.000000000 +0200
+++ shadow-4.0.3/lib/gshadow.c	2005-02-23 14:07:08.116765685 +0100
@@ -48,12 +48,10 @@
  static	int	dbmerror;
  #endif

-#define	MAXMEM	1024
-
  static	FILE	*shadow;
  static	char	sgrbuf[BUFSIZ*4];
-static	char	*members[MAXMEM+1];
-static	char	*admins[MAXMEM+1];
+static	char	**members = NULL; static size_t nmembers = 0;
+static	char	**admins = NULL; static size_t nadmins = 0;
  static	struct	sgrp	sgroup;

  extern	char	*fgetsx();
@@ -105,17 +103,25 @@
  #endif

  static char **
-list(char *s, char **l)
-{
-	int	nmembers = 0;
-
-	while (s && *s) {
-		l[nmembers++] = s;
-		if ((s = strchr (s, ',')))
-			*s++ = '\0';
+list(char *s, char **list[], size_t *nlist) {
+	char **ptr = *list;
+	size_t nelem = *nlist, size;
+
+	while (s != NULL && *s != '\0') {
+		size = (nelem + 1) * sizeof(ptr);
+		if ((ptr = realloc(*list, size)) != NULL) {
+			ptr[nelem++] = s;
+			*list = ptr; *nlist = nelem;
+			if ((s = strchr(s, ',')))
+				*s++ = '\0';
+		}
+	}
+	size = (nelem + 1) * sizeof(ptr);
+	if ((ptr = realloc(*list, size)) != NULL) {
+		ptr[nelem] = '\0';
+		*list = ptr;
  	}
-	l[nmembers] = (char *) 0;
-	return l;
+	return ptr;
  }

  void
@@ -215,8 +221,20 @@

  	sgroup.sg_name = fields[0];
  	sgroup.sg_passwd = fields[1];
-	sgroup.sg_adm = list (fields[2], admins);
-	sgroup.sg_mem = list (fields[3], members);
+	if(nadmins)
+	{
+		nadmins=0;
+		free(admins);
+		admins=NULL;
+	}
+	if(nmembers)
+	{
+		nmembers=0;
+		free(members);
+		members=NULL;
+	}
+	sgroup.sg_adm = list (fields[2], &admins, &nadmins);
+	sgroup.sg_mem = list (fields[3], &members, &nmembers);

  	return &sgroup;
  }

John Newbigin wrote:

> I have reported this problem before and I really would like it resolved. 
>  There is a static buffer used by shadow groups which is easily overrun 
> if too many users are added into the same group.
> 
> The problem is the buffer size defined in /lib/gshadow.c line 51
> #define       MAXMEM  1024
> 
> Gets filled.  As a workaround I increase the buffer size but this should 
> be fixed.
> 
> See https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=125510
> 
> I have coded a patch which does dynamic allocation but the existing code 
> seems a bit funny so a rewrite is possibly required.  I am willing to do 
> this if someone wants to check it for me.
> 
> John.
> 


-- 
John Newbigin
Computer Systems Officer
Faculty of Information and Communication Technologies
Swinburne University of Technology
Melbourne, Australia
http://www.it.swin.edu.au/staff/jnewbigin