Bugzilla – Attachment 539 Details for
Bug 787
Minor security problem due to use of deprecated NGROUPS_MAX in uidswap.c (sshd)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Use sysconf where available for NGROUPS_MAX.
openssh-ngroups.patch (text/plain), 3.11 KB, created by
Darren Tucker
on 2004-02-06 20:44:15 AEDT
(
hide
)
Description:
Use sysconf where available for NGROUPS_MAX.
Filename:
MIME Type:
Creator:
Darren Tucker
Created:
2004-02-06 20:44:15 AEDT
Size:
3.11 KB
patch
obsolete
>Index: defines.h >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/defines.h,v >retrieving revision 1.109 >diff -u -p -r1.109 defines.h >--- defines.h 27 Jan 2004 05:40:35 -0000 1.109 >+++ defines.h 6 Feb 2004 09:27:45 -0000 >@@ -541,6 +541,10 @@ struct winsize { > # define SSH_SYSFDMAX 10000 > #endif > >+#ifdef HAVE_SYSCONF >+# undef NGROUPS_MAX >+# define NGROUPS_MAX (sysconf(_SC_NGROUPS_MAX)) >+#endif > > /* > * Define this to use pipes instead of socketpairs for communicating with the >Index: groupaccess.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/groupaccess.c,v >retrieving revision 1.7 >diff -u -p -r1.7 groupaccess.c >--- groupaccess.c 14 May 2003 03:40:07 -0000 1.7 >+++ groupaccess.c 6 Feb 2004 09:38:54 -0000 >@@ -31,7 +31,7 @@ RCSID("$OpenBSD: groupaccess.c,v 1.6 200 > #include "log.h" > > static int ngroups; >-static char *groups_byname[NGROUPS_MAX + 1]; /* +1 for base/primary group */ >+static char **groups_byname = NULL; > > /* > * Initialize group access list for user with primary (base) and >@@ -40,10 +40,16 @@ static char *groups_byname[NGROUPS_MAX + > int > ga_init(const char *user, gid_t base) > { >- gid_t groups_bygid[NGROUPS_MAX + 1]; >+ gid_t *groups_bygid; > int i, j; > struct group *gr; > >+ if (groups_byname == NULL) >+ groups_byname = xmalloc( sizeof(*groups_byname) * >+ (NGROUPS_MAX + 1)); /* +1 for base/primary group */ >+ >+ groups_bygid = xmalloc(sizeof(*groups_bygid) * (NGROUPS_MAX + 1)); >+ > if (ngroups > 0) > ga_free(); > >@@ -85,4 +91,7 @@ ga_free(void) > xfree(groups_byname[i]); > ngroups = 0; > } >+ >+ xfree(groups_byname); >+ groups_byname = NULL; > } >Index: uidswap.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/uidswap.c,v >retrieving revision 1.42 >diff -u -p -r1.42 uidswap.c >--- uidswap.c 17 Dec 2003 07:53:26 -0000 1.42 >+++ uidswap.c 6 Feb 2004 09:26:41 -0000 >@@ -16,6 +16,7 @@ RCSID("$OpenBSD: uidswap.c,v 1.24 2003/0 > > #include "log.h" > #include "uidswap.h" >+#include "xmalloc.h" > > /* > * Note: all these functions must work in all of the following cases: >@@ -38,9 +39,18 @@ static gid_t saved_egid = 0; > /* Saved effective uid. */ > static int privileged = 0; > static int temporarily_use_uid_effective = 0; >-static gid_t saved_egroups[NGROUPS_MAX], user_groups[NGROUPS_MAX]; >+static gid_t *saved_egroups = NULL, *user_groups = NULL; > static int saved_egroupslen = -1, user_groupslen = -1; > >+static void >+init_saved_groups(void) >+{ >+ if (saved_egroups == NULL) >+ saved_egroups = xmalloc(NGROUPS_MAX * sizeof(*saved_egroups)); >+ if (user_groups == NULL) >+ user_groups = xmalloc(NGROUPS_MAX * sizeof(*user_groups)); >+} >+ > /* > * Temporarily changes to the given uid. If the effective user > * id is not root, this does nothing. This call cannot be nested. >@@ -48,6 +58,7 @@ static int saved_egroupslen = -1, user_g > void > temporarily_use_uid(struct passwd *pw) > { >+ init_saved_groups(); > /* Save the current euid, and egroups. */ > #ifdef SAVED_IDS_WORK_WITH_SETEUID > saved_euid = geteuid();
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 787
:
539
|
548
|
549
|
550
|
551