CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677)

Using alloca matches what other caches do.  The request length is
bounded by MAXKEYLEN.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Gbp-Pq: Topic all
Gbp-Pq: Name git-0001-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch

diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
index c89629aec8741ab5386e21e5b90a8da83c464248..0e9581c0ced1fe97f51531d200a088d4bf545407 100644 (file)
--- a/nscd/netgroupcache.c
+++ b/nscd/netgroupcache.c
@@ -503,12 +503,13 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req,
       = (struct indataset *) mempool_alloc (db,
                                            sizeof (*dataset) + req->key_len,
                                            1);
-  struct indataset dataset_mem;
   bool cacheable = true;
   if (__glibc_unlikely (dataset == NULL))
     {
       cacheable = false;
-      dataset = &dataset_mem;
+      /* The alloca is safe because nscd_run_worker verfies that
+        key_len is not larger than MAXKEYLEN.  */
+      dataset = alloca (sizeof (*dataset) + req->key_len);
     }
 
   datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len,