From caa6e77293d85e31dfde371b78862e9330a1478e Mon Sep 17 00:00:00 2001 From: Ulrich Drepper Date: Wed, 3 Feb 2010 06:23:31 -0800 Subject: [PATCH] Fix endless loop with invalid /etc/shells file. --- ChangeLog | 6 ++++++ misc/getusershell.c | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index e8aad25..f895a8c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2010-02-03 Ulrich Drepper + + [BZ #11242] + * misc/getusershell.c (initshells): Allocate one more byte in input + buffer so that fgets doesn't loop undefinitely. + 2010-02-02 Ulrich Drepper * stdlib/setenv.c (__add_to_environ): Don't use alloca if diff --git a/misc/getusershell.c b/misc/getusershell.c index 636da32..0e4f796 100644 --- a/misc/getusershell.c +++ b/misc/getusershell.c @@ -116,7 +116,8 @@ initshells() } if (statb.st_size > ~(size_t)0 / sizeof (char *) * 3) goto init_okshells; - if ((strings = malloc(statb.st_size + 2)) == NULL) + flen = statb.st_size + 3; + if ((strings = malloc(flen)) == NULL) goto init_okshells; shells = malloc(statb.st_size / 3 * sizeof (char *)); if (shells == NULL) { @@ -126,7 +127,6 @@ initshells() } sp = shells; cp = strings; - flen = statb.st_size + 2; while (fgets_unlocked(cp, flen - (cp - strings), fp) != NULL) { while (*cp != '#' && *cp != '/' && *cp != '\0') cp++; -- 2.7.4