[Bug 4496] passwd applet ruins UID field in /etc/passwd

Wed Nov 23 01:05:19 UTC 2011

https://bugs.busybox.net/show_bug.cgi?id=4496

--- Comment #11 from Denys Vlasenko <vda.linux at googlemail.com> 2011-11-23 01:05:19 UTC ---
> Started gdb and gdb-server:
> - I ran the code until strstr(filename, "shadow")
> - I then requested some (register) states
> (gdb) x/i $pc
> => 0x90c1c <update_passwd+12>:    bl    0xc860 <strstr>
> (gdb) x/s $r0
> 0x9e21b:     "/etc/shadow"
> (gdb) x/s $r1
> 0x9e220:     "shadow"
> 
> I noticed that R1 (the needle) overlaps R0 (the haystack). Could this cause the
> problem. I guess this might be the result of the Os flag. However it seems that
> this is allowed... (I could only find that memcpy is not allowed to overlap).

That's the first call to strstr (see comment #1). Continue, and stop on the
second call. It should check "/etc/passwd" against "shadow".

Then step over bl instruction, and check return value. What r0 points to?

-- 
Configure bugmail: https://bugs.busybox.net/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.