Skip to content

Commit 0b746d2

Browse files
simo5frozencemetery
authored andcommitted
Fix truncation on comparison in name attr maps
The check to match a mapped name to a named attribute inadvertently considered only the length of one of the strings. This would cause incorrect prefix matches. Signed-off-by: Simo Sorce <simo@redhat.com>
1 parent 7e2c046 commit 0b746d2

File tree

3 files changed

+9
-3
lines changed

3 files changed

+9
-3
lines changed

src/environ.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -340,9 +340,8 @@ void mag_get_name_attributes(request_rec *req, struct mag_config *cfg,
340340
/* Use the environment variable name matching the attribute name
341341
* from the map. */
342342
for (int j = 0; j < map_count; j++) {
343-
if (strncmp(cfg->name_attributes->map[j].attr_name,
344-
attr.name.value,
345-
attr.name.length) == 0) {
343+
if (mag_strbuf_equal(cfg->name_attributes->map[j].attr_name,
344+
&attr.name)) {
346345
attr.env_name = cfg->name_attributes->map[j].env_name;
347346
break;
348347
}

src/mod_auth_gssapi.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,4 @@ const char *mag_str_auth_type(int auth_type);
142142
char *mag_error(apr_pool_t *pool, const char *msg, uint32_t maj, uint32_t min);
143143
int mag_get_user_uid(const char *name, uid_t *uid);
144144
int mag_get_group_gid(const char *name, gid_t *gid);
145+
bool mag_strbuf_equal(const char *str, gss_buffer_t buf);

src/util.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,9 @@ int mag_get_group_gid(const char *name, gid_t *gid)
6464
free(buf);
6565
return ret;
6666
}
67+
68+
bool mag_strbuf_equal(const char *str, gss_buffer_t buf)
69+
{
70+
if (strncmp(str, buf->value, buf->length) != 0) return false;
71+
return buf->length == strlen(str);
72+
}

0 commit comments

Comments
 (0)