harden realloc/free to detect simple overflows

[musl] / src / passwd / getgrent_a.c

diff --git a/src/passwd/getgrent_a.c b/src/passwd/getgrent_a.c
index ccb51d5..2cb8521 100644 (file)
--- a/src/passwd/getgrent_a.c
+++ b/src/passwd/getgrent_a.c
@@ -1,16 +1,26 @@
 #include "pwf.h"
+#include <pthread.h>
+
+static unsigned atou(char **s)
+{
+       unsigned x;
+       for (x=0; **s-'0'<10U; ++*s) x=10*x+(**s-'0');
+       return x;
+}
 
 struct group *__getgrent_a(FILE *f, struct group *gr, char **line, size_t *size, char ***mem, size_t *nmem)
 {
        ssize_t l;
        char *s, *mems;
        size_t i;
-
+       int cs;
+       pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
        for (;;) {
                if ((l=getline(line, size, f)) < 0) {
                        free(*line);
                        *line = 0;
-                       return 0;
+                       gr = 0;
+                       goto end;
                }
                line[0][l-1] = 0;
 
@@ -21,8 +31,8 @@ struct group *__getgrent_a(FILE *f, struct group *gr, char **line, size_t *size,
                *s++ = 0; gr->gr_passwd = s;
                if (!(s = strchr(s, ':'))) continue;
 
-               *s++ = 0; gr->gr_gid = atoi(s);
-               if (!(s = strchr(s, ':'))) continue;
+               *s++ = 0; gr->gr_gid = atou(&s);
+               if (*s != ':') continue;
 
                *s++ = 0; mems = s;
                break;
@@ -37,10 +47,16 @@ struct group *__getgrent_a(FILE *f, struct group *gr, char **line, size_t *size,
                *line = 0;
                return 0;
        }
-       mem[0][0] = mems;
-       for (s=mems, i=0; *s; s++)
-               if (*s==',') *s++ = 0, mem[0][++i] = s;
-       mem[0][++i] = 0;
+       if (*mems) {
+               mem[0][0] = mems;
+               for (s=mems, i=0; *s; s++)
+                       if (*s==',') *s++ = 0, mem[0][++i] = s;
+               mem[0][++i] = 0;
+       } else {
+               mem[0][0] = 0;
+       }
        gr->gr_mem = *mem;
+end:
+       pthread_setcancelstate(cs, 0);
        return gr;
 }