Changeset 3232 in MondoRescue for branches/3.2/mindi-busybox/libbb/die_if_bad_username.c

Timestamp:

Jan 1, 2014, 12:47:38 AM (10 years ago)

Author:

Bruno Cornec

Message:

• Update mindi-busybox to 1.21.1

File:

• branches/3.2/mindi-busybox/libbb/die_if_bad_username.c (modified) (1 diff)

branches/3.2/mindi-busybox/libbb/die_if_bad_username.c

@@ -19 +19 @@
 void FAST_FUNC die_if_bad_username(const char *name)
 {
-    /* 1st char being dash or dot isn't valid: */
+    const char *start = name;
+
+    /* 1st char being dash or dot isn't valid:
+     * for example, name like ".." can make adduser
+     * chown "/home/.." recursively - NOT GOOD.
+     * Name of just a single "$" is also rejected.
+     */
     goto skip;
-    /* For example, name like ".." can make adduser
-     * chown "/home/.." recursively - NOT GOOD
-     */
 
     do {
-        if (*name == '-' || *name == '.')
-            continue;
- skip:
-        if (isalnum(*name)
-         || *name == '_'
-         || *name == '@'
+        unsigned char ch;
+
+        /* These chars are valid unless they are at the 1st pos: */
+        if (*name == '-'
+         || *name == '.'
+        /* $ is allowed if it's the last char: */
          || (*name == '$' && !name[1])
         ) {
             continue;
         }
-        bb_error_msg_and_die("illegal character '%c'", *name);
+ skip:
+        ch = *name;
+        if (ch == '_'
+        /* || ch == '@' -- we disallow this too. Think about "user@host" */
+        /* open-coded isalnum: */
+         || (ch >= '0' && ch <= '9')
+         || ((ch|0x20) >= 'a' && (ch|0x20) <= 'z')
+        ) {
+            continue;
+        }
+        bb_error_msg_and_die("illegal character with code %u at position %u",
+                (unsigned)ch, (unsigned)(name - start));
     } while (*++name);
+
+    /* The minimum size of the login name is one char or two if
+     * last char is the '$'. Violations of this are caught above.
+     * The maximum size of the login name is LOGIN_NAME_MAX
+     * including the terminating null byte.
+     */
+    if (name - start >= LOGIN_NAME_MAX)
+        bb_error_msg_and_die("name is too long");
 }