diff --git a/lib/defines.h b/lib/defines.h --- a/lib/defines.h +++ b/lib/defines.h @@ -388,4 +388,7 @@ extern char *strerror (); # define shadow_getenv(name) getenv(name) #endif +/* Maximum length of passwd entry */ +#define PASSWD_ENTRY_MAX_LENGTH 32768 + #endif /* _DEFINES_H_ */ diff --git a/lib/pwio.c b/lib/pwio.c --- a/lib/pwio.c +++ b/lib/pwio.c @@ -79,7 +79,10 @@ static int passwd_put (const void *ent, FILE * file) || (pw->pw_gid == (gid_t)-1) || (valid_field (pw->pw_gecos, ":\n") == -1) || (valid_field (pw->pw_dir, ":\n") == -1) - || (valid_field (pw->pw_shell, ":\n") == -1)) { + || (valid_field (pw->pw_shell, ":\n") == -1) + || (strlen (pw->pw_name) + strlen (pw->pw_passwd) + + strlen (pw->pw_gecos) + strlen (pw->pw_dir) + + strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) { return -1; } diff --git a/lib/sgetpwent.c b/lib/sgetpwent.c --- a/lib/sgetpwent.c +++ b/lib/sgetpwent.c @@ -57,7 +57,7 @@ struct passwd *sgetpwent (const char *buf) { static struct passwd pwent; - static char pwdbuf[1024]; + static char pwdbuf[PASSWD_ENTRY_MAX_LENGTH]; register int i; register char *cp; char *fields[NFIELDS]; @@ -67,8 +67,10 @@ struct passwd *sgetpwent (const char *buf) * the password structure remain valid. */ - if (strlen (buf) >= sizeof pwdbuf) + if (strlen (buf) >= sizeof pwdbuf) { + fprintf (stderr, "Too long passwd entry encountered, file corruption?\n"); return 0; /* fail if too long */ + } strcpy (pwdbuf, buf); /* diff --git a/lib/sgetspent.c b/lib/sgetspent.c --- a/lib/sgetspent.c +++ b/lib/sgetspent.c @@ -48,7 +48,7 @@ */ struct spwd *sgetspent (const char *string) { - static char spwbuf[1024]; + static char spwbuf[PASSWD_ENTRY_MAX_LENGTH]; static struct spwd spwd; char *fields[FIELDS]; char *cp; @@ -61,6 +61,7 @@ struct spwd *sgetspent (const char *string) */ if (strlen (string) >= sizeof spwbuf) { + fprintf (stderr, "Too long shadow entry encountered, file corruption?\n"); return 0; /* fail if too long */ } strcpy (spwbuf, string); diff --git a/lib/shadowio.c b/lib/shadowio.c --- a/lib/shadowio.c +++ b/lib/shadowio.c @@ -79,7 +79,9 @@ static int shadow_put (const void *ent, FILE * file) if ( (NULL == sp) || (valid_field (sp->sp_namp, ":\n") == -1) - || (valid_field (sp->sp_pwdp, ":\n") == -1)) { + || (valid_field (sp->sp_pwdp, ":\n") == -1) + || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) + + 1000 > PASSWD_ENTRY_MAX_LENGTH)) { return -1; }