From 809cde4a640032f2f87319c9358be4fee8d6d7d5 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Sat, 11 Jun 2016 12:12:56 +0200
Subject: [PATCH] nss_db: Fix initialization of iteration position [BZ #20237]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When get*ent is called without a preceding set*ent, we need
to set the initial iteration position in get*ent.
Reproducer: Add “services: db files” to /etc/nsswitch.conf, then run
“perl -e getservent”. It will segfault before this change, and exit
silently after it.
(cherry picked from commit 31d0a4fa646db8b8c97ce24e0ec0a7b73de4fca1)
---
ChangeLog | 7 +++++++
nss/nss_db/db-XXX.c | 8 +++++++-
2 files changed, 14 insertions(+), 1 deletion(-)
#diff --git a/ChangeLog b/ChangeLog
#index 3541385..bb8d618 100644
#--- a/ChangeLog
#+++ b/ChangeLog
#@@ -1,3 +1,10 @@
#+2016-06-11 Florian Weimer <fweimer@redhat.com>
#+
#+ [BZ #20237]
#+ * nss/nss_db/db-XXX.c (set*ent): Reset entidx to NULL.
#+ (get*ent): Set entidx to NULL during initialization. If entidx is
#+ NULL, start iteration from the beginning.
#+
# 2016-06-30 Andreas Schwab <schwab@suse.de>
#
# [BZ #20262]
diff --git a/nss/nss_db/db-XXX.c b/nss/nss_db/db-XXX.c
index 4a0766a..70b58be 100644
--- a/nss/nss_db/db-XXX.c
+++ b/nss/nss_db/db-XXX.c
@@ -77,7 +77,7 @@ CONCAT(_nss_db_set,ENTNAME) (int stayopen)
keep_db |= stayopen;
/* Reset the sequential index. */
- entidx = (const char *) state.header + state.header->valstroffset;
+ entidx = NULL;
}
__libc_lock_unlock (lock);
@@ -253,8 +253,14 @@ CONCAT(_nss_db_get,ENTNAME_r) (struct STRUCTURE *result, char *buffer,
H_ERRNO_SET (NETDB_INTERNAL);
goto out;
}
+ entidx = NULL;
}
+ /* Start from the beginning if freshly initialized or reset
+ requested by set*ent. */
+ if (entidx == NULL)
+ entidx = (const char *) state.header + state.header->valstroffset;
+
status = NSS_STATUS_UNAVAIL;
if (state.header != MAP_FAILED)
{
--
2.10.2
