Browse Source

vtysh: Fix, guard against NULL pointer dereference

getpwuid() may fail returning a null value leaving subsequent
code vulnerable to a null pointer dereference.

Tested-by: NetDEF CI System <cisystem@netdef.org>
Jafar Al-Gharaibeh 3 years ago
parent
commit
f5a4488a0d
1 changed files with 5 additions and 1 deletions
  1. 5 1
      vtysh/vtysh_user.c

+ 5 - 1
vtysh/vtysh_user.c

@@ -176,7 +176,11 @@ vtysh_auth (void)
   struct vtysh_user *user;
   struct passwd *passwd;
 
-  passwd = getpwuid (geteuid ());
+  if ((passwd = getpwuid (geteuid ())) == NULL)
+  {
+    fprintf (stderr, "could not lookup user ID %d\n", (int) geteuid());
+    exit (1);
+  }
 
   user = user_lookup (passwd->pw_name);
   if (user && user->nopassword)