Bug 73450

From Bugzilla Helper:
User-Agent: Mozilla/5.0 Galeon/1.2.0 (X11; Linux i686; U;) Gecko/20020408

Description of problem:
Lines in /etc/group are truncated if enough users are added to a group to make
the line length > 8k.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
Instal RH linux, and run this program:

#! /usr/bin/perl -w

use strict;

foreach my $user (0..1100)
{
	$user = "user$user";
	print "Doing user $user\n";
	system("/usr/sbin/useradd", "$user");
	system("/usr/sbin/usermod", "-G", "shared", "$user");
}



	

Actual Results: 
shared:x:500:public,admin,www,user0,user1,user2,user3,user4,user5,user6,\
...
user513,user514,user515,user516,user517,user518,user519,user520,user521,user1100



Expected Results: 
shared:x:500:public,admin,www,user0,user1,user2,user3,user4,user5,user6,user7,user8,\
...
user1095,user1096,user1097,user1098,user1099,user1100


Additional info:

This was noticed, and a fix promised, long ago:

http://security-archive.merton.ox.ac.uk/security-audit-200009/0002.html

[snip]
> I'm using #4 for my PAM'ified systems now. Still need to "port" some
> of the reliability fixes I did for libpwdb to the password file I/O
> routines found in shadow-utils.

Just curious, what are these fixes? These routines were meant to be
quite reliable, though I have received one bug report recently: very
long lines (>8K characters) in group files are truncated (this is a
very old bug, but reported after shadow-20000826 was released, so I'll
probably make another bugfix release soon, probably the last one from
me after all these years...). 
[snip]

The bug is fixed in the PLD version of the package:

http://rpmfind.net/linux/PLD/current/software/shadow/NEWS

...
- fix bug discovered and fixed by Marcel Ritter
  <Marcel.Ritter.de>
Due to a big buffer size in lib/commonio.c this error does only appear
  if a line gets longer than 4096 bytes (there are probably very few people
  stumbling across this).
  Ths bug can be exposed by trashing /etc/groups file using useradd with script:
	#!/bin/sh
	typeset -i NUM
	NUM=0
	groupadd demogroup
	while [ $NUM -le 1000 ]; do
	   useradd -g demogroup -G demogroup -p "NONE" user$NUM
	   NUM=$NUM+1
	done
...


This patch to lib/commonio.c is the relevant bit of their fix:

... 
 	while (db->ops->fgets(buf, buflen, db->fp)) {
 
	while (!(cp = strrchr(buf, '\n')) && !feof(db->fp)) {
+
		int len;
+
 
		buflen += BUFLEN;
 
		cp = (char *) realloc(buf, buflen);
 
		if (!cp)
 
			goto cleanup_buf;
 
		buf = cp;
-
		db->ops->fgets(buf + buflen - BUFLEN, BUFLEN, db->fp);
+
		len = strlen(buf);
+
		db->ops->fgets(buf + len, buflen - len, db->fp);
 
	}
 
	if ((cp = strrchr(buf, '\n')))
 
		*cp = '\0';