Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 4 product line. The current stable release is 4.9. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 164815

Summary:	NSCD buffer overflow for large gids
Product:	Red Hat Enterprise Linux 4	Reporter:	Elena Zannoni <ezannoni>
Component:	glibc	Assignee:	Jakub Jelinek <jakub>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0	CC:	drepper, roland
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:	RHBA-2005-678	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-10-05 16:43:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	163538
Bug Blocks:	156322

Description Elena Zannoni 2005-08-01 16:11:20 UTC

+++ This bug was initially created as a clone of Bug #163538 +++

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050623
Fedora/1.0.4-5 Firefox/1.0.4

Description of problem:
diff -aru glibc-orig/nscd/grpcache.c glibc-nscd-fix/nscd/grpcache.c
--- glibc-orig/nscd/grpcache.c  2005-02-22 17:53:39.000000000 -0500
+++ glibc-nscd-fix/nscd/grpcache.c      2005-07-18 01:36:20.000000000 -0400
@@ -167,7 +167,7 @@
       char *gr_name;
       char *cp;
       const size_t key_len = strlen (key);
-      const size_t buf_len = 3 + sizeof (grp->gr_gid) + key_len + 1;
+      const size_t buf_len = 3 * sizeof (grp->gr_gid) + key_len + 1;
       char *buf = alloca (buf_len);
       ssize_t n;
       size_t cnt;


Version-Release number of selected component (if applicable):
glibc-2.3.90-2

How reproducible:
Didn't try


Additional info:

Comment 2 Red Hat Bugzilla 2005-10-05 16:43:03 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2005-678.html