From 8ce0155157b2698e849ebd4aede2567cbc9986ee Mon Sep 17 00:00:00 2001 From: Baptiste Daroussin Date: Sat, 1 Aug 2015 10:10:13 +0000 Subject: Validate the max_uid/max_gid boundaries and entry type in pw.conf --- pw/pw_conf.c | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) (limited to 'pw/pw_conf.c') diff --git a/pw/pw_conf.c b/pw/pw_conf.c index d351a8f..c6a86b7 100644 --- a/pw/pw_conf.c +++ b/pw/pw_conf.c @@ -230,6 +230,7 @@ read_userconfig(char const * file) char *buf, *p; size_t linecap; ssize_t linelen; + const char *errstr; buf = NULL; linecap = 0; @@ -323,20 +324,35 @@ read_userconfig(char const * file) ? NULL : newstr(q); break; case _UC_MINUID: - if ((q = unquote(q)) != NULL && isdigit(*q)) - config.min_uid = (uid_t) atol(q); + if ((q = unquote(q)) != NULL) { + errstr = NULL; + config.min_uid = strtounum(q, 0, UID_MAX, &errstr); + if (errstr) + warnx("Invalid min_uid: '%s', ignoring", q); + } break; case _UC_MAXUID: - if ((q = unquote(q)) != NULL && isdigit(*q)) - config.max_uid = (uid_t) atol(q); + if ((q = unquote(q)) != NULL) { + errstr = NULL; + config.max_uid = strtounum(q, 0, UID_MAX, &errstr); + if (errstr) + warnx("Invalid max_uid: '%s', ignoring", q); + } break; case _UC_MINGID: if ((q = unquote(q)) != NULL && isdigit(*q)) - config.min_gid = (gid_t) atol(q); + errstr = NULL; + config.min_gid = strtounum(q, 0, GID_MAX, &errstr); + if (errstr) + warnx("Invalid min_gid: '%s', ignoring", q); break; case _UC_MAXGID: - if ((q = unquote(q)) != NULL && isdigit(*q)) - config.max_gid = (gid_t) atol(q); + if ((q = unquote(q)) != NULL) { + errstr = NULL; + config.max_gid = strtounum(q, 0, GID_MAX, &errstr); + if (errstr) + warnx("Invalid max_gid: '%s', ignoring", q); + } break; case _UC_EXPIRE: if ((q = unquote(q)) != NULL && isdigit(*q)) -- cgit v1.2.3