1 /* Test for bug 17079: heap overflow in NSS with small buffers.
2 Copyright (C) 2015-2023 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
9
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
14
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <https://www.gnu.org/licenses/>. */
18
19 #include <errno.h>
20 #include <nss.h>
21 #include <pwd.h>
22 #include <stdbool.h>
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26
27 #include <support/support.h>
28
29 /* Check if two passwd structs contain the same data. */
30 static bool
31 equal (const struct passwd *a, const struct passwd *b)
32 {
33 return strcmp (a->pw_name, b->pw_name) == 0
34 && strcmp (a->pw_passwd, b->pw_passwd) == 0
35 && a->pw_uid == b->pw_uid
36 && a->pw_gid == b->pw_gid
37 && strcmp (a->pw_gecos, b->pw_gecos) == 0
38 && strcmp (a->pw_dir, b->pw_dir) == 0
39 && strcmp (a->pw_shell, b->pw_shell) == 0;
40 }
41
42 enum { MAX_TEST_ITEMS = 10 };
43 static struct passwd test_items[MAX_TEST_ITEMS];
44 static int test_count;
45
46 /* Initialize test_items and test_count above, with data from the
47 passwd database. */
48 static bool
49 init_test_items (void)
50 {
51 setpwent ();
52 do
53 {
54 struct passwd *pwd = getpwent ();
55 if (pwd == NULL)
56 break;
57 struct passwd *target = test_items + test_count;
58 target->pw_name = xstrdup (pwd->pw_name);
59 target->pw_passwd = xstrdup (pwd->pw_passwd);
60 target->pw_uid = pwd->pw_uid;
61 target->pw_gid = pwd->pw_gid;
62 target->pw_gecos = xstrdup (pwd->pw_gecos);
63 target->pw_dir = xstrdup (pwd->pw_dir);
64 target->pw_shell = xstrdup (pwd->pw_shell);
65 }
66 while (++test_count < MAX_TEST_ITEMS);
67 endpwent ();
68
69 /* Filter out those test items which cannot be looked up by name or
70 UID. */
71 bool found = false;
72 for (int i = 0; i < test_count; ++i)
73 {
74 struct passwd *pwd1 = getpwnam (test_items[i].pw_name);
75 struct passwd *pwd2 = getpwuid (test_items[i].pw_uid);
76 if (pwd1 == NULL || !equal (pwd1, test_items + i)
77 || pwd2 == NULL || !equal (pwd2, test_items + i))
78 {
79 printf ("info: skipping user \"%s\", UID %ld due to inconsistency\n",
80 test_items[i].pw_name, (long) test_items[i].pw_uid);
81 test_items[i].pw_name = NULL;
82 }
83 else
84 found = true;
85 }
86
87 if (!found)
88 puts ("error: no accounts found which can be looked up by name and UID.");
89 return found;
90 }
91
92 /* Set to true if an error is encountered. */
93 static bool errors;
94
95 /* Return true if the padding has not been tampered with. */
96 static bool
97 check_padding (char *buffer, size_t size, char pad)
98 {
99 char *end = buffer + size;
100 while (buffer < end)
101 {
102 if (*buffer != pad)
103 return false;
104 ++buffer;
105 }
106 return true;
107 }
108
109 /* Test one buffer size and padding combination. */
110 static void
111 test_one (const struct passwd *item, size_t buffer_size,
112 char pad, size_t padding_size)
113 {
114 char *buffer = xmalloc (buffer_size + padding_size);
115
116 struct passwd pwd;
117 struct passwd *result;
118 int ret;
119
120 /* Test getpwname_r. */
121 memset (buffer, pad, buffer_size + padding_size);
122 pwd = (struct passwd) {};
123 ret = getpwnam_r (item->pw_name, &pwd, buffer, buffer_size, &result);
124 if (!check_padding (buffer + buffer_size, padding_size, pad))
125 {
126 printf ("error: padding change: "
127 "name \"%s\", buffer size %zu, padding size %zu, pad 0x%02x\n",
128 item->pw_name, buffer_size, padding_size, (unsigned char) pad);
129 errors = true;
130 }
131 if (ret == 0)
132 {
133 if (result == NULL)
134 {
135 printf ("error: no data: name \"%s\", buffer size %zu\n",
136 item->pw_name, buffer_size);
137 errors = true;
138 }
139 else if (!equal (item, result))
140 {
141 printf ("error: lookup mismatch: name \"%s\", buffer size %zu\n",
142 item->pw_name, buffer_size);
143 errors = true;
144 }
145 }
146 else if (ret != ERANGE)
147 {
148 errno = ret;
149 printf ("error: lookup failure for name \"%s\": %m (%d)\n",
150 item->pw_name, ret);
151 errors = true;
152 }
153
154 /* Test getpwuid_r. */
155 memset (buffer, pad, buffer_size + padding_size);
156 pwd = (struct passwd) {};
157 ret = getpwuid_r (item->pw_uid, &pwd, buffer, buffer_size, &result);
158 if (!check_padding (buffer + buffer_size, padding_size, pad))
159 {
160 printf ("error: padding change: "
161 "UID %ld, buffer size %zu, padding size %zu, pad 0x%02x\n",
162 (long) item->pw_uid, buffer_size, padding_size,
163 (unsigned char) pad);
164 errors = true;
165 }
166 if (ret == 0)
167 {
168 if (result == NULL)
169 {
170 printf ("error: no data: UID %ld, buffer size %zu\n",
171 (long) item->pw_uid, buffer_size);
172 errors = true;
173 }
174 else if (!equal (item, result))
175 {
176 printf ("error: lookup mismatch: UID %ld, buffer size %zu\n",
177 (long) item->pw_uid, buffer_size);
178 errors = true;
179 }
180 }
181 else if (ret != ERANGE)
182 {
183 errno = ret;
184 printf ("error: lookup failure for UID \"%ld\": %m (%d)\n",
185 (long) item->pw_uid, ret);
186 errors = true;
187 }
188
189 free (buffer);
190 }
191
192 /* Test one buffer size with different paddings. */
193 static void
194 test_buffer_size (size_t buffer_size)
195 {
196 for (int i = 0; i < test_count; ++i)
197 for (size_t padding_size = 0; padding_size < 3; ++padding_size)
198 {
199 /* Skip entries with inconsistent name/UID lookups. */
200 if (test_items[i].pw_name == NULL)
201 continue;
202
203 test_one (test_items + i, buffer_size, '\0', padding_size);
204 if (padding_size > 0)
205 {
206 test_one (test_items + i, buffer_size, ':', padding_size);
207 test_one (test_items + i, buffer_size, '\n', padding_size);
208 test_one (test_items + i, buffer_size, '\xff', padding_size);
209 test_one (test_items + i, buffer_size, '@', padding_size);
210 }
211 }
212 }
213
214 int
215 do_test (void)
216 {
217 __nss_configure_lookup ("passwd", "files");
218
219 if (!init_test_items ())
220 return 1;
221 printf ("info: %d test items\n", test_count);
222
223 for (size_t buffer_size = 0; buffer_size <= 65; ++buffer_size)
224 test_buffer_size (buffer_size);
225 for (size_t buffer_size = 64 + 4; buffer_size < 256; buffer_size += 4)
226 test_buffer_size (buffer_size);
227 test_buffer_size (255);
228 test_buffer_size (257);
229 for (size_t buffer_size = 256; buffer_size < 512; buffer_size += 8)
230 test_buffer_size (buffer_size);
231 test_buffer_size (511);
232 test_buffer_size (513);
233 test_buffer_size (1024);
234 test_buffer_size (2048);
235
236 if (errors)
237 return 1;
238 else
239 return 0;
240 }
241
242 #include <support/test-driver.c>