qiurui
/
glibc
mirror of git://sourceware.org/git/glibc.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677) 

Using alloca matches what other caches do.  The request length is
bounded by MAXKEYLEN.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
This commit is contained in:
Florian Weimer 2024-04-25 15:00:45 +02:00
parent 3a3a449742
commit 87801a8fd0
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
nscd/netgroupcache.c
View File

@ -502,12 +502,13 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req,
= (struct indataset *) mempool_alloc (db, = (struct indataset *) mempool_alloc (db,
sizeof (*dataset) + req->key_len, sizeof (*dataset) + req->key_len,
1); 1);
struct indataset dataset_mem;
bool cacheable = true; bool cacheable = true;
if (__glibc_unlikely (dataset == NULL)) if (__glibc_unlikely (dataset == NULL))
{ {
cacheable = false; cacheable = false;
dataset = &dataset_mem; /* The alloca is safe because nscd_run_worker verfies that
key_len is not larger than MAXKEYLEN. */
dataset = alloca (sizeof (*dataset) + req->key_len);
} }
datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len, datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len,