From: Simon Wilkinson <sxw@your-file-system.com>
Date: Tue, 26 Feb 2013 22:27:25 +0000 (+0000)
Subject: auth: Fix buffer overflow in afsconf_Open
X-Git-Tag: openafs-stable-1_8_0pre1~1399
X-Git-Url: https://git.openafs.org/?p=openafs.git;a=commitdiff_plain;h=41d9ea697bf5e81e5003ad7b208788223c25536b

auth: Fix buffer overflow in afsconf_Open

If we fallback to the .AFSCONF file in the user's homedirectory,
the results of getenv("HOME") are copied into a fixed length string,
without checking for overflows.

Instead of risking this, just use asprintf to dynamically construct
a string, and free it when we are done.

Caught by coverity (#985905)

Change-Id: Id8769ede841165d3ff3104143e55767d550d6f87
Reviewed-on: http://gerrit.openafs.org/9292
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Derrick Brashear <shadow@your-file-system.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
---

diff --git a/src/auth/cellconfig.c b/src/auth/cellconfig.c
index b0f7d39..08cc6be 100644
--- a/src/auth/cellconfig.c
+++ b/src/auth/cellconfig.c
@@ -461,10 +461,18 @@ afsconf_Open(const char *adir)
 		fgets(afs_confdir, 128, fp);
 		fclose(fp);
 	    } else {
-		char pathname[256];
+		char *pathname = NULL;
+
+		asprintf(&pathname, "%s/%s", home_dir, ".AFSCONF");
+		if (pathname == NULL) {
+		    free(tdir);
+		    UNLOCK_GLOBAL_MUTEX;
+		    return (struct afsconf_dir *) 0;
+		}
 
-		sprintf(pathname, "%s/%s", home_dir, ".AFSCONF");
 		fp = fopen(pathname, "r");
+		free(pathname);
+
 		if (fp == 0) {
 		    /* Our last chance is the "/.AFSCONF" file */
 		    fp = fopen("/.AFSCONF", "r");