diff options
| author | Tobias Stoeckmann <tobias@stoeckmann.org> | 2023-11-11 13:58:06 +0100 |
|---|---|---|
| committer | Dmitry V. Levin <github.dl@altlinux.org> | 2023-11-12 22:53:37 +0000 |
| commit | cb13aa40cb4ea0c8f1d12d79cbf9ed94828c837f (patch) | |
| tree | af4d0ea66a50509207739c4745bd3a9cb388b539 /libpam/pam_misc.c | |
| parent | da3bc2fc01c2443486ac1d241c4a09eaa71083c6 (diff) | |
| download | pam-cb13aa40cb4ea0c8f1d12d79cbf9ed94828c837f.tar.gz pam-cb13aa40cb4ea0c8f1d12d79cbf9ed94828c837f.tar.bz2 pam-cb13aa40cb4ea0c8f1d12d79cbf9ed94828c837f.zip | |
libpam: fix integer overflow when parsing configs
It is possible to trigger a signed integer overflow when parsing
jump numbers for pam return types.
Fail if the number becomes too large.
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Diffstat (limited to 'libpam/pam_misc.c')
| -rw-r--r-- | libpam/pam_misc.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/libpam/pam_misc.c b/libpam/pam_misc.c index 4c53451f..22b613e1 100644 --- a/libpam/pam_misc.c +++ b/libpam/pam_misc.c @@ -37,6 +37,7 @@ #include "pam_private.h" +#include <limits.h> #include <stdarg.h> #include <stdlib.h> #include <stdio.h> @@ -329,8 +330,17 @@ void _pam_parse_control(int *control_array, char *tok) /* parse a number */ act = 0; do { + int digit = *tok - '0'; + if (act > INT_MAX / 10) { + error = "expecting smaller jump number"; + goto parse_error; + } act *= 10; - act += *tok - '0'; /* XXX - this assumes ascii behavior */ + if (act > INT_MAX - digit) { + error = "expecting smaller jump number"; + goto parse_error; + } + act += digit; /* XXX - this assumes ascii behavior */ } while (*++tok && isdigit((unsigned char)*tok)); if (! act) { /* we do not allow 0 jumps. There is a token ('ignore') |