Bug 1698015

Summary: glibc: Calling getpwent after endpwent should not crash?
Product: Red Hat Enterprise Linux 7 Reporter: Paulo Andrade <pandrade>
Component: glibcAssignee: DJ Delorie <dj>
Status: CLOSED ERRATA QA Contact: qe-baseos-tools-bugs
Severity: medium Docs Contact:
Priority: medium    
Version: 7.6CC: ashankar, bgollahe, codonell, dj, fweimer, mnewsome, pfrankli, skolosov
Target Milestone: rcKeywords: Patch
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: glibc-2.17-302.el7 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of:
: 1747502 (view as bug list) Environment:
Last Closed: 2020-03-31 19:08:32 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1710258    

Description Paulo Andrade 2019-04-09 12:52:36 UTC 
To setup the problem, edit /etc/nsswith.conf and add 'db' first, for example
-passwd files sss
+passwd db files sss

  Then, this example program will crash if setpwent is not called:

"""
#include <stdio.h>
#include <sys/types.h>
#include <pwd.h>
#include <grp.h>

void main()
{
    int usercnt;
    int grpcnt;
    struct passwd *p;

    // setpwent();  not absolutely required but good practice
    p = getpwent();
    for(usercnt = 0; p; p = getpwent(), usercnt++);
    endpwent();

//    setpwent(); if uncomment it the code does not segfault
    p = getpwent();
    for(usercnt = 0; p; p = getpwent(), usercnt++) {
        printf("%s (%d)\tHOME %s\tSHELL %s\n", p->pw_name, p->pw_uid, p->pw_dir, p->pw_shell);
    }
    setpwent();
}
"""

  If not using passwd.db apparently the default behaviour is to have
endpwent to implicitly rewind, so, setpwent is somewhat useless other
than when using a database.

  Is the crash (due to reading past the end of the stream) expected?
Comment 2 Florian Weimer 2019-04-09 13:17:31 UTC 
Confirmed.  This is distinct from bug 1213603.
Comment 9 Sergey Kolosov 2019-11-15 22:00:24 UTC 
Verified with the reproducer
Comment 11 errata-xmlrpc 2020-03-31 19:08:32 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0989