https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=191427
Bug ID: 191427
Summary: "pw userdel" can go into an infinite loop
Product: Base System
Version: 10.0-RELEASE
Hardware: Any
OS: Any
Status: Needs Triage
Severity: Affects Many People
Priority: Normal
Component: bin
Assignee: freebsd-bugs@FreeBSD.org
Reporter: yen...@cs.washington.edu
There is an infinite loop in /usr/src/usr.sbin/pw/pw_user.c.
Below is a code segment from pw_user.c:
if (!strcmp(grp->gr_mem[i], a_name->val)) {
while (grp->gr_mem[i] != NULL) {
grp->gr_mem[i] = grp->gr_mem[i+1];
}
strlcpy(group, grp->gr_name, MAXLOGNAME);
chggrent(group, grp);
}
Note that the index variable i in the while loop is static.
If the content of gr_mem[i+1] being copied is not NULL, the
while loop would run forever.
Environment:
System: FreeBSD bld017c1e.cs.washington.edu 10.0-RELEASE-p6 FreeBSD
10.0-RELEASE-p6 #0: Tue Jun 24 07:47:37 UTC 2014
r...@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64
How-To-Repeat:
It is obvious from the code. However, to be certain, become
root and run the following commands:
pw useradd test
pw groupmod test -M 'test,root'
pw userdel test
The last command would run forever. For cleaning up the 'test'
group, hit Ctrl-C and then run the following command.
pw groupdel test
Fix:
Here is one way to fix it:
--- pw_user.c 2014/06/26 21:39:49 1.1
+++ pw_user.c 2014/06/26 21:41:18
@@ -429,12 +429,14 @@
delgrent(GETGRNAM(a_name->val));
SETGRENT();
while ((grp = GETGRENT()) != NULL) {
- int i;
+ int i,j;
char group[MAXLOGNAME];
for (i = 0; grp->gr_mem[i] != NULL; i++) {
if (!strcmp(grp->gr_mem[i], a_name->val)) {
- while (grp->gr_mem[i] != NULL) {
- grp->gr_mem[i] = grp->gr_mem[i+1];
+ j = i;
+ while (grp->gr_mem[j] != NULL) {
+ grp->gr_mem[j] = grp->gr_mem[j+1];
+ j += 1;
}
strlcpy(group, grp->gr_name, MAXLOGNAME);
chggrent(group, grp);
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
