0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

Userland: Fix null-pointer deref on unknown user/group in chown/chgrp

Browse source 
We can't just blindly dereference the result of getpwnam()/getgrnam()!

Fixes #1625.
This commit is contained in:
Andreas Kling 2020-04-04 19:29:30 +02:00
parent 54cb1e36b6
commit 040ba77d44
Notes: sideshowbarker 2024-07-19 07:56:15 +09:00
2 changed files with 11 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
Userland/chgrp.cpp
View file

@ -56,12 +56,12 @@ int main(int argc, char** argv)
new_gid = gid_arg.to_uint(ok);
if (!ok) {
new_gid = getgrnam(gid_arg.characters())->gr_gid;
if(!new_gid) {
fprintf(stderr, "Invalid gid: '%s'\n", gid_arg.characters());
auto* group = getgrnam(gid_arg.characters());
if (!group) {
fprintf(stderr, "Unknown group '%s'\n", gid_arg.characters());
return 1;
}
new_gid = group->gr_gid;
}
int rc = chown(argv[2], -1, new_gid);

14
Userland/chown.cpp
View file

@ -57,23 +57,23 @@ int main(int argc, char** argv)
bool ok;
new_uid = parts[0].to_uint(ok);
if (!ok) {
new_uid = getpwnam(parts[0].characters())->pw_uid;
if (!new_uid) {
fprintf(stderr, "Invalid uid: '%s'\n", parts[0].characters());
auto* passwd = getpwnam(parts[0].characters());
if (!passwd) {
fprintf(stderr, "Unknown user '%s'\n", parts[0].characters());
return 1;
}
new_uid = passwd->pw_uid;
}
if (parts.size() == 2) {
new_gid = parts[1].to_uint(ok);
if (!ok) {
new_gid = getgrnam(parts[1].characters())->gr_gid;
auto* group = getgrnam(parts[1].characters());
if (!new_gid) {
fprintf(stderr, "Invalid gid: '%s'\n", parts[1].characters());
fprintf(stderr, "Unknown group '%s'\n", parts[1].characters());
return 1;
}
new_gid = group->gr_gid;
}
}