307 lines
10 KiB
Diff
307 lines
10 KiB
Diff
commit 2f498f3d140ab5152bd784df2be7af7d9c5e63ed
|
|
Author: Florian Weimer <fweimer@redhat.com>
|
|
Date: Tue Aug 14 10:57:48 2018 +0200
|
|
|
|
nss_files: Fix file stream leak in aliases lookup [BZ #23521]
|
|
|
|
In order to get a clean test case, it was necessary to fix partially
|
|
fixed bug 23522 as well.
|
|
|
|
(cherry picked from commit e95c6f61920a0f9237cfb292fa44ad500e1df09b)
|
|
|
|
diff --git a/nss/Makefile b/nss/Makefile
|
|
index 66fac7f5b8a4c0d8..5209fc0456dd6786 100644
|
|
--- a/nss/Makefile
|
|
+++ b/nss/Makefile
|
|
@@ -65,6 +65,7 @@ ifeq (yes,$(build-shared))
|
|
tests += tst-nss-files-hosts-erange
|
|
tests += tst-nss-files-hosts-multi
|
|
tests += tst-nss-files-hosts-getent
|
|
+tests += tst-nss-files-alias-leak
|
|
endif
|
|
|
|
# If we have a thread library then we can test cancellation against
|
|
@@ -171,3 +172,5 @@ endif
|
|
$(objpfx)tst-nss-files-hosts-erange: $(libdl)
|
|
$(objpfx)tst-nss-files-hosts-multi: $(libdl)
|
|
$(objpfx)tst-nss-files-hosts-getent: $(libdl)
|
|
+$(objpfx)tst-nss-files-alias-leak: $(libdl)
|
|
+$(objpfx)tst-nss-files-alias-leak.out: $(objpfx)/libnss_files.so
|
|
diff --git a/nss/nss_files/files-alias.c b/nss/nss_files/files-alias.c
|
|
index cfd34b66b921bbff..35b0bfc5d2479ab6 100644
|
|
--- a/nss/nss_files/files-alias.c
|
|
+++ b/nss/nss_files/files-alias.c
|
|
@@ -221,6 +221,13 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
|
|
{
|
|
while (! feof_unlocked (listfile))
|
|
{
|
|
+ if (room_left < 2)
|
|
+ {
|
|
+ free (old_line);
|
|
+ fclose (listfile);
|
|
+ goto no_more_room;
|
|
+ }
|
|
+
|
|
first_unused[room_left - 1] = '\xff';
|
|
line = fgets_unlocked (first_unused, room_left,
|
|
listfile);
|
|
@@ -229,6 +236,7 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
|
|
if (first_unused[room_left - 1] != '\xff')
|
|
{
|
|
free (old_line);
|
|
+ fclose (listfile);
|
|
goto no_more_room;
|
|
}
|
|
|
|
@@ -256,6 +264,7 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
|
|
+ __alignof__ (char *)))
|
|
{
|
|
free (old_line);
|
|
+ fclose (listfile);
|
|
goto no_more_room;
|
|
}
|
|
room_left -= ((first_unused - cp)
|
|
diff --git a/nss/tst-nss-files-alias-leak.c b/nss/tst-nss-files-alias-leak.c
|
|
new file mode 100644
|
|
index 0000000000000000..26d38e2dba1ddaf3
|
|
--- /dev/null
|
|
+++ b/nss/tst-nss-files-alias-leak.c
|
|
@@ -0,0 +1,237 @@
|
|
+/* Check for file descriptor leak in alias :include: processing (bug 23521).
|
|
+ Copyright (C) 2018 Free Software Foundation, Inc.
|
|
+ This file is part of the GNU C Library.
|
|
+
|
|
+ The GNU C Library is free software; you can redistribute it and/or
|
|
+ modify it under the terms of the GNU Lesser General Public
|
|
+ License as published by the Free Software Foundation; either
|
|
+ version 2.1 of the License, or (at your option) any later version.
|
|
+
|
|
+ The GNU C Library is distributed in the hope that it will be useful,
|
|
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
+ Lesser General Public License for more details.
|
|
+
|
|
+ You should have received a copy of the GNU Lesser General Public
|
|
+ License along with the GNU C Library; if not, see
|
|
+ <http://www.gnu.org/licenses/>. */
|
|
+
|
|
+#include <aliases.h>
|
|
+#include <array_length.h>
|
|
+#include <dlfcn.h>
|
|
+#include <errno.h>
|
|
+#include <gnu/lib-names.h>
|
|
+#include <nss.h>
|
|
+#include <stdlib.h>
|
|
+#include <string.h>
|
|
+#include <support/check.h>
|
|
+#include <support/namespace.h>
|
|
+#include <support/support.h>
|
|
+#include <support/temp_file.h>
|
|
+#include <support/test-driver.h>
|
|
+#include <support/xstdio.h>
|
|
+#include <support/xunistd.h>
|
|
+
|
|
+static struct support_chroot *chroot_env;
|
|
+
|
|
+/* Number of the aliases for the "many" user. This must be large
|
|
+ enough to trigger reallocation for the pointer array, but result in
|
|
+ answers below the maximum size tried in do_test. */
|
|
+enum { many_aliases = 30 };
|
|
+
|
|
+static void
|
|
+prepare (int argc, char **argv)
|
|
+{
|
|
+ chroot_env = support_chroot_create
|
|
+ ((struct support_chroot_configuration) { } );
|
|
+
|
|
+ char *path = xasprintf ("%s/etc/aliases", chroot_env->path_chroot);
|
|
+ add_temp_file (path);
|
|
+ support_write_file_string
|
|
+ (path,
|
|
+ "user1: :include:/etc/aliases.user1\n"
|
|
+ "user2: :include:/etc/aliases.user2\n"
|
|
+ "comment: comment1, :include:/etc/aliases.comment\n"
|
|
+ "many: :include:/etc/aliases.many\n");
|
|
+ free (path);
|
|
+
|
|
+ path = xasprintf ("%s/etc/aliases.user1", chroot_env->path_chroot);
|
|
+ add_temp_file (path);
|
|
+ support_write_file_string (path, "alias1\n");
|
|
+ free (path);
|
|
+
|
|
+ path = xasprintf ("%s/etc/aliases.user2", chroot_env->path_chroot);
|
|
+ add_temp_file (path);
|
|
+ support_write_file_string (path, "alias1a, alias2\n");
|
|
+ free (path);
|
|
+
|
|
+ path = xasprintf ("%s/etc/aliases.comment", chroot_env->path_chroot);
|
|
+ add_temp_file (path);
|
|
+ support_write_file_string
|
|
+ (path,
|
|
+ /* The line must be longer than the line with the :include:
|
|
+ directive in /etc/aliases. */
|
|
+ "# Long line. ##############################################\n"
|
|
+ "comment2\n");
|
|
+ free (path);
|
|
+
|
|
+ path = xasprintf ("%s/etc/aliases.many", chroot_env->path_chroot);
|
|
+ add_temp_file (path);
|
|
+ FILE *fp = xfopen (path, "w");
|
|
+ for (int i = 0; i < many_aliases; ++i)
|
|
+ fprintf (fp, "a%d\n", i);
|
|
+ TEST_VERIFY_EXIT (! ferror (fp));
|
|
+ xfclose (fp);
|
|
+ free (path);
|
|
+}
|
|
+
|
|
+/* The names of the users to test. */
|
|
+static const char *users[] = { "user1", "user2", "comment", "many" };
|
|
+
|
|
+static void
|
|
+check_aliases (int id, const struct aliasent *e)
|
|
+{
|
|
+ TEST_VERIFY_EXIT (id >= 0 || id < array_length (users));
|
|
+ const char *name = users[id];
|
|
+ TEST_COMPARE_BLOB (e->alias_name, strlen (e->alias_name),
|
|
+ name, strlen (name));
|
|
+
|
|
+ switch (id)
|
|
+ {
|
|
+ case 0:
|
|
+ TEST_COMPARE (e->alias_members_len, 1);
|
|
+ TEST_COMPARE_BLOB (e->alias_members[0], strlen (e->alias_members[0]),
|
|
+ "alias1", strlen ("alias1"));
|
|
+ break;
|
|
+
|
|
+ case 1:
|
|
+ TEST_COMPARE (e->alias_members_len, 2);
|
|
+ TEST_COMPARE_BLOB (e->alias_members[0], strlen (e->alias_members[0]),
|
|
+ "alias1a", strlen ("alias1a"));
|
|
+ TEST_COMPARE_BLOB (e->alias_members[1], strlen (e->alias_members[1]),
|
|
+ "alias2", strlen ("alias2"));
|
|
+ break;
|
|
+
|
|
+ case 2:
|
|
+ TEST_COMPARE (e->alias_members_len, 2);
|
|
+ TEST_COMPARE_BLOB (e->alias_members[0], strlen (e->alias_members[0]),
|
|
+ "comment1", strlen ("comment1"));
|
|
+ TEST_COMPARE_BLOB (e->alias_members[1], strlen (e->alias_members[1]),
|
|
+ "comment2", strlen ("comment2"));
|
|
+ break;
|
|
+
|
|
+ case 3:
|
|
+ TEST_COMPARE (e->alias_members_len, many_aliases);
|
|
+ for (int i = 0; i < e->alias_members_len; ++i)
|
|
+ {
|
|
+ char alias[30];
|
|
+ int len = snprintf (alias, sizeof (alias), "a%d", i);
|
|
+ TEST_VERIFY_EXIT (len > 0);
|
|
+ TEST_COMPARE_BLOB (e->alias_members[i], strlen (e->alias_members[i]),
|
|
+ alias, len);
|
|
+ }
|
|
+ break;
|
|
+ }
|
|
+}
|
|
+
|
|
+static int
|
|
+do_test (void)
|
|
+{
|
|
+ /* Make sure we don't try to load the module in the chroot. */
|
|
+ if (dlopen (LIBNSS_FILES_SO, RTLD_NOW) == NULL)
|
|
+ FAIL_EXIT1 ("could not load " LIBNSS_FILES_SO ": %s", dlerror ());
|
|
+
|
|
+ /* Some of these descriptors will become unavailable if there is a
|
|
+ file descriptor leak. 10 is chosen somewhat arbitrarily. The
|
|
+ array must be longer than the number of files opened by nss_files
|
|
+ at the same time (currently that number is 2). */
|
|
+ int next_descriptors[10];
|
|
+ for (size_t i = 0; i < array_length (next_descriptors); ++i)
|
|
+ {
|
|
+ next_descriptors[i] = dup (0);
|
|
+ TEST_VERIFY_EXIT (next_descriptors[i] > 0);
|
|
+ }
|
|
+ for (size_t i = 0; i < array_length (next_descriptors); ++i)
|
|
+ xclose (next_descriptors[i]);
|
|
+
|
|
+ support_become_root ();
|
|
+ if (!support_can_chroot ())
|
|
+ return EXIT_UNSUPPORTED;
|
|
+
|
|
+ __nss_configure_lookup ("aliases", "files");
|
|
+
|
|
+ xchroot (chroot_env->path_chroot);
|
|
+
|
|
+ /* Attempt various buffer sizes. If the operation succeeds, we
|
|
+ expect correct data. */
|
|
+ for (int id = 0; id < array_length (users); ++id)
|
|
+ {
|
|
+ bool found = false;
|
|
+ for (size_t size = 1; size <= 1000; ++size)
|
|
+ {
|
|
+ void *buffer = malloc (size);
|
|
+ struct aliasent result;
|
|
+ struct aliasent *res;
|
|
+ errno = EINVAL;
|
|
+ int ret = getaliasbyname_r (users[id], &result, buffer, size, &res);
|
|
+ if (ret == 0)
|
|
+ {
|
|
+ if (res != NULL)
|
|
+ {
|
|
+ found = true;
|
|
+ check_aliases (id, res);
|
|
+ }
|
|
+ else
|
|
+ {
|
|
+ support_record_failure ();
|
|
+ printf ("error: failed lookup for user \"%s\", size %zu\n",
|
|
+ users[id], size);
|
|
+ }
|
|
+ }
|
|
+ else if (ret != ERANGE)
|
|
+ {
|
|
+ support_record_failure ();
|
|
+ printf ("error: invalid return code %d (user \%s\", size %zu)\n",
|
|
+ ret, users[id], size);
|
|
+ }
|
|
+ free (buffer);
|
|
+
|
|
+ /* Make sure that we did not have a file descriptor leak. */
|
|
+ for (size_t i = 0; i < array_length (next_descriptors); ++i)
|
|
+ {
|
|
+ int new_fd = dup (0);
|
|
+ if (new_fd != next_descriptors[i])
|
|
+ {
|
|
+ support_record_failure ();
|
|
+ printf ("error: descriptor %d at index %zu leaked"
|
|
+ " (user \"%s\", size %zu)\n",
|
|
+ next_descriptors[i], i, users[id], size);
|
|
+
|
|
+ /* Close unexpected descriptor, the leak probing
|
|
+ descriptors, and the leaked descriptor
|
|
+ next_descriptors[i]. */
|
|
+ xclose (new_fd);
|
|
+ for (size_t j = 0; j <= i; ++j)
|
|
+ xclose (next_descriptors[j]);
|
|
+ goto next_size;
|
|
+ }
|
|
+ }
|
|
+ for (size_t i = 0; i < array_length (next_descriptors); ++i)
|
|
+ xclose (next_descriptors[i]);
|
|
+
|
|
+ next_size:
|
|
+ ;
|
|
+ }
|
|
+ if (!found)
|
|
+ {
|
|
+ support_record_failure ();
|
|
+ printf ("error: user %s not found\n", users[id]);
|
|
+ }
|
|
+ }
|
|
+
|
|
+ support_chroot_free (chroot_env);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+#define PREPARE prepare
|
|
+#include <support/test-driver.c>
|