Harden putpwent, putgrent, putspent, putspent against injection [BZ #18724]

This prevents injection of ':' and '\n' into output functions which
use the NSS files database syntax.  Critical fields (user/group names
and file system paths) are checked strictly.  For backwards
compatibility, the GECOS field is rewritten instead.

The getent program is adjusted to use the put*ent functions in libc,
instead of local copies.  This changes the behavior of getent if user
names start with '-' or '+'.

1 files changed, 9 insertions, 0 deletions

diff --git a/shadow/putspent.c b/shadow/putspent.c
index 142e697e64..ba8230a482 100644
--- a/shadow/putspent.c
+++ b/shadow/putspent.c
@@ -15,6 +15,8 @@
    License along with the GNU C Library; if not, see
    <http://www.gnu.org/licenses/>.  */
 
+#include <errno.h>
+#include <nss.h>
 #include <stdio.h>
 #include <shadow.h>
 
@@ -31,6 +33,13 @@ putspent (const struct spwd *p, FILE *stream)
 {
   int errors = 0;
 
+  if (p->sp_namp == NULL || !__nss_valid_field (p->sp_namp)
+      || !__nss_valid_field (p->sp_pwdp))
+    {
+      __set_errno (EINVAL);
+      return -1;
+    }
+
   flockfile (stream);
 
   if (fprintf (stream, "%s:%s:", p->sp_namp, _S (p->sp_pwdp)) < 0)