[Bug 191427] New: "pw userdel" can go into an infinite loop

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=191427

            Bug ID: 191427
           Summary: "pw userdel" can go into an infinite loop
           Product: Base System
           Version: 10.0-RELEASE
          Hardware: Any
                OS: Any
            Status: Needs Triage
          Severity: Affects Many People
          Priority: Normal
         Component: bin
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: yenbut at cs.washington.edu

There is an infinite loop in /usr/src/usr.sbin/pw/pw_user.c.
    Below is a code segment from pw_user.c:

           if (!strcmp(grp->gr_mem[i], a_name->val)) {
         while (grp->gr_mem[i] != NULL) {
           grp->gr_mem[i] = grp->gr_mem[i+1];
         }
         strlcpy(group, grp->gr_name, MAXLOGNAME);
         chggrent(group, grp);
       }

    Note that the index variable i in the while loop is static.
    If the content of gr_mem[i+1] being copied is not NULL, the
    while loop would run forever.

Environment:
System: FreeBSD bld017c1e.cs.washington.edu 10.0-RELEASE-p6 FreeBSD
10.0-RELEASE-p6 #0: Tue Jun 24 07:47:37 UTC 2014
root at amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64

How-To-Repeat:
It is obvious from the code.  However, to be certain, become
    root and run the following commands:

    pw useradd test
    pw groupmod test -M 'test,root'
    pw userdel test

    The last command would run forever. For cleaning up the 'test'
    group, hit Ctrl-C and then run the following command.

    pw groupdel test

Fix:
Here is one way to fix it:

--- pw_user.c    2014/06/26 21:39:49    1.1
+++ pw_user.c    2014/06/26 21:41:18
@@ -429,12 +429,14 @@
                 delgrent(GETGRNAM(a_name->val));
             SETGRENT();
             while ((grp = GETGRENT()) != NULL) {
-                int i;
+                    int i,j;
                 char group[MAXLOGNAME];
                 for (i = 0; grp->gr_mem[i] != NULL; i++) {
                     if (!strcmp(grp->gr_mem[i], a_name->val)) {
-                        while (grp->gr_mem[i] != NULL) {
-                            grp->gr_mem[i] = grp->gr_mem[i+1];
+                            j = i;
+                        while (grp->gr_mem[j] != NULL) {
+                            grp->gr_mem[j] = grp->gr_mem[j+1];
+                            j += 1;
                         }    
                         strlcpy(group, grp->gr_name, MAXLOGNAME);
                         chggrent(group, grp);

-- 
You are receiving this mail because:
You are the assignee for the bug.