Repository navigation
Conversation
The passwd and group parsers discard integer conversion errors, which turns malformed UID and GID fields into zero. On 32-bit systems, overflowing values can also saturate to the maximum valid ID. Reject invalid and out-of-range UID/GID fields, skipping those passwd/group entries while continuing to parse valid entries. Add regression coverage for malformed, negative, and overflowing IDs. Fixes: moby#248 Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
Collaborator
|
@thaJeztah is working on that in #230, so closing this one. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ParsePasswdFilterandParseGroupFiltercurrently discard integer conversion errors, turning malformed IDs into zero. On 32-bit systems, some overflow values can also saturate to the maximumintand appear valid.Return errors from the internal numeric parser, reject IDs outside the supported range, and skip malformed passwd/group entries while continuing to parse valid rows. Add regression tests for nonnumeric, negative, and overflowing UID/GID values.
Tested on Fedora 44 ARM64:
cd user && go test ./...cd user && go vet ./...Fixes #248.