isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

validate_env_vars: more efficient errbuf handling

Browse Source 
Also avoid appending to errbuf if it is already full.
This commit is contained in:
Todd C. Miller
2022-12-28 09:24:22 -07:00
parent 95a6c04598
commit 9c4271f737
1 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
plugins/sudoers/env.c
View File

@@ -1145,7 +1145,8 @@ bool
validate_env_vars(char * const env_vars[]) validate_env_vars(char * const env_vars[])
{ {
char * const *ep; char * const *ep;
char *eq, errbuf[4096]; char errbuf[4096];
char *errpos = errbuf;
bool okvar, ret = true; bool okvar, ret = true;
debug_decl(validate_env_vars, SUDOERS_DEBUG_ENV); debug_decl(validate_env_vars, SUDOERS_DEBUG_ENV);
@@ -1153,7 +1154,6 @@ validate_env_vars(char * const env_vars[])
debug_return_bool(true); /* nothing to do */ debug_return_bool(true); /* nothing to do */
/* Add user-specified environment variables. */ /* Add user-specified environment variables. */
errbuf[0] = '\0';
for (ep = env_vars; *ep != NULL; ep++) { for (ep = env_vars; *ep != NULL; ep++) {
if (def_secure_path && !user_is_exempt() && if (def_secure_path && !user_is_exempt() &&
strncmp(*ep, "PATH=", 5) == 0) { strncmp(*ep, "PATH=", 5) == 0) {
@@ -1164,20 +1164,21 @@ validate_env_vars(char * const env_vars[])
okvar = !env_should_delete(*ep); okvar = !env_should_delete(*ep);
} }
if (okvar == false) { if (okvar == false) {
/* Not allowed, add to error string, allocating as needed. */ /* Not allowed, append to error buffer if space remains. */
if ((eq = strchr(*ep, '=')) != NULL) if (errpos < &errbuf[sizeof(errbuf)]) {
*eq = '\0'; size_t varlen = strcspn(*ep, "=");
if (errbuf[0] != '\0') int len = snprintf(errpos, sizeof(errbuf) - (errpos - errbuf),
(void)strlcat(errbuf, ", ", sizeof(errbuf)); "%s%.*s", errpos != errbuf ? ", " : "", (int)varlen, *ep);
if (strlcat(errbuf, *ep, sizeof(errbuf)) >= sizeof(errbuf)) { if (len >= ssizeof(errbuf) - (errpos - errbuf)) {
errbuf[sizeof(errbuf) - 4] = '\0'; memcpy(&errbuf[sizeof(errbuf) - 4], "...", 4);
(void)strlcat(errbuf, "...", sizeof(errbuf)); errpos = &errbuf[sizeof(errbuf)];
} else {
errpos += len;
}
} }
if (eq != NULL)
*eq = '=';
} }
} }
if (errbuf[0] != '\0') { if (errpos != errbuf) {
/* XXX - audit? */ /* XXX - audit? */
log_warningx(0, log_warningx(0,
N_("sorry, you are not allowed to set the following environment variables: %s"), errbuf); N_("sorry, you are not allowed to set the following environment variables: %s"), errbuf);