2012/6/4 Nicolas François <[email protected]>: > Hello, > > On Sun, Jun 03, 2012 at 06:54:16PM +0400, [email protected] wrote: >> >> Function __pw_dup() in lib/pwmem.c allocates uninitialized memory for struct >> passwd and then fills some members of that struct, but other members (e. g. >> pw_age) are still uninitialized. It can results in segfault in putpwent() >> which >> tests for pw_age. > > lib/pwmem.c copies all members according to the getpwent(3) or putpwent(3) > man pages or /usr/include/pwd.h (libc6-dev 2.13-32). > > I could not find a definition of struct passwd with a pw_age field. > > I could copy or initialize the complete structure in case there are > redefinition of this structure with more fields, but it could be as > harmful as not doing anything. > > Can you provide more details?
Here: https://github.com/illumos/illumos-gate/blob/master/usr/src/head/pwd.h#L48 ================= >8 ================ struct passwd { char *pw_name; char *pw_passwd; uid_t pw_uid; gid_t pw_gid; char *pw_age; char *pw_comment; char *pw_gecos; char *pw_dir; char *pw_shell; }; ================= 8< ================ And here: https://github.com/illumos/illumos-gate/blob/master/usr/src/lib/libc/port/gen/putpwent.c#L46 ================= >8 ================ if (((p->pw_age) != NULL) && ((*p->pw_age) != '\0')) (void) fprintf(f, ",%s", p->pw_age); /* fatal "," */ ================= 8< ================ So it *is* possible, and I think it is safer to set the whole structure to zero values. -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
