diff options
| author | Tobias Stoeckmann <tobias@stoeckmann.org> | 2023-12-21 11:40:14 +0100 |
|---|---|---|
| committer | Dmitry V. Levin <ldv@strace.io> | 2023-12-21 10:40:14 +0000 |
| commit | 2d34803074153b5adc2ddca11ed0ef99d8b7d5b0 (patch) | |
| tree | 54a2857b618eac307c10ab06036c645088ebd191 | |
| parent | b4a989962b6f5eb1f5a88c02782517f00b29621d (diff) | |
| download | pam-2d34803074153b5adc2ddca11ed0ef99d8b7d5b0.tar.gz pam-2d34803074153b5adc2ddca11ed0ef99d8b7d5b0.tar.bz2 pam-2d34803074153b5adc2ddca11ed0ef99d8b7d5b0.zip | |
pam_motd: fail if too many motd files encountered
Prevent signed integer overflow if too many motd files are encountered.
Use the easiest approach for such an unlikely scenario.
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
| -rw-r--r-- | modules/pam_motd/pam_motd.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/modules/pam_motd/pam_motd.c b/modules/pam_motd/pam_motd.c index 5ca486e4..dd84bcf0 100644 --- a/modules/pam_motd/pam_motd.c +++ b/modules/pam_motd/pam_motd.c @@ -7,6 +7,7 @@ #include "config.h" +#include <limits.h> #include <stdio.h> #include <string.h> #include <stdlib.h> @@ -174,7 +175,7 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, unsigned int dirscans_size_total = 0; char **dirnames_all = NULL; unsigned int i; - int i_dirnames = 0; + unsigned int i_dirnames = 0; if (pamh == NULL || motd_dir_path_split == NULL) { goto out; @@ -203,6 +204,10 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, } else { dirscans_sizes[i] = rv; } + if (dirscans_size_total > UINT_MAX - dirscans_sizes[i]) { + pam_syslog(pamh, LOG_CRIT, "encountered too many motd files"); + goto out; + } dirscans_size_total += dirscans_sizes[i]; } |