[SSSD] [PATCH] Don't pass user input as a printf format string argument

Stef Walter stefw at redhat.com
Tue Jan 7 13:07:52 UTC 2014


full_name_format is documented as a printf(3) compatible format string,
and the util.c implementation passes that string to snprintf after some
sneaky hacks to make it actually work ...

It's not good practice to pass user input (even admin input) to printf
directly. Doing so leads to crashes and abort()'s when the format string
isn't just right. This probably isn't exploitable, but as usual it's
hard to be sure :)

Fedora and others check for sorta thing with -Wformat-security flags.

Unlike regular expressions, printf format strings aren't meant for user
provided input. There are probably better choices for the
full_name_format syntax. I think any work on that should be separate
from this patch.

Anyhow, here's a patch which aims to make the full_name_format printf
handling both correct and safe.

This patch includes safe-printf.[ch] from the realmd project, which are
written with just standard libc deps, and uses it for formatting fully
qualified names. [1]

In addition there were various corner cases and assumptions about the
format strings, such as the exact syntax of the args, the length of the
output, etc... which I've fixed in this patch.

Tests are added and updated.

I'll be happy to split the patch into two, if desired. One which adds
safe-printf.[ch] + tests, and the second which fixes the fully qualified
names.

I believe that this patch also simplifies fqname handling code.

Cheers,

Stef

[1] realmd currently uses full_name_format to build it's LoginFormats
property. Once sssd is on the system DBus bus, realmd might be able to
ask sssd for this directly...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-NSS-Don-t-use-printf-3-on-user-provided-strings.patch
Type: text/x-patch
Size: 43921 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140107/8627424c/attachment.bin>


More information about the sssd-devel mailing list