Commits on Oct 16, 2024

1. Fix coverity unbound buffer issues …

   During coverity scan, there are reported four issues
   with unbounded source buffer for each usage of input arg
   directly with syslog function.
   
   Sample coverity test report for chsh.c file:
   
    1. string_size_argv: argv contains strings with unknown size.
    int main (int argc, char **argv)
   [...]
    4. var_assign_var: Assigning: user = argv[optind]. Both are now tainted.
    user = argv[optind];
   [...]
   CID 5771784: (shadow-maint#1 of 1): Unbounded source buffer (STRING_SIZE)
   15. string_size: Passing string user of unknown size to syslog.
    SYSLOG ((LOG_INFO, "changed user '%s' shell to '%s'", user, loginsh));
   
   Similar issue is reported three times more:
   File: chfn.c, function: main, variable: user
   File: passwd.c, function: main, variable: name
   File: newgrp.c, function: main, variable: group
   
   This commit is the first approach to fix the reported issues.
   The proposed changes add conditions, which verify
   the user and group names arguments, including their lengths.
   This will not silence the coverity reports, but the change causes
   that they are irrelevant and could be ignored.

   

   MarcinDigitic authored and mnconlusive committed Oct 16, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for e381b2d
   • Browse repository at this point

   Copy the full SHA

   e381b2d View commit details

   Browse the repository at this point in the history