glibc/nscd, branch master

nscd: Use time_t for return type of addgetnetgrentX

2024-05-02T16:59:29Z

Using int may give false results for future dates (timeouts after the year 2028). Fixes commit 04a21e050d64a1193a6daab872bca2528bda44b ("CVE-2024-33601, CVE-2024-33602: nscd: netgroup: Use two buffers in addgetnetgrentX (bug 31680)"). Reviewed-by: Carlos O'Donell

nscd: Typo inside comment in netgroup cache

2024-05-02T08:33:24Z

Reported-by: Jonathan Wakely

CVE-2024-33601, CVE-2024-33602: nscd: netgroup: Use two buffers in addgetnetgrentX (bug 31680)

2024-04-25T13:01:07Z

This avoids potential memory corruption when the underlying NSS callback function does not use the buffer space to store all strings (e.g., for constant strings). Instead of custom buffer management, two scratch buffers are used. This increases stack usage somewhat. Scratch buffer allocation failure is handled by return -1 (an invalid timeout value) instead of terminating the process. This fixes bug 31679. Reviewed-by: Siddhesh Poyarekar

CVE-2024-33600: nscd: Avoid null pointer crashes after notfound response (bug 31678)

2024-04-25T13:01:07Z

The addgetnetgrentX call in addinnetgrX may have failed to produce a result, so the result variable in addinnetgrX can be NULL. Use db->negtimeout as the fallback value if there is no result data; the timeout is also overwritten below. Also avoid sending a second not-found response. (The client disconnects after receiving the first response, so the data stream did not go out of sync even without this fix.) It is still beneficial to add the negative response to the mapping, so that the client can get it from there in the future, instead of going through the socket. Reviewed-by: Siddhesh Poyarekar

CVE-2024-33600: nscd: Do not send missing not-found response in addgetnetgrentX (bug 31678)

2024-04-25T13:01:07Z

If we failed to add a not-found response to the cache, the dataset point can be null, resulting in a null pointer dereference. Reviewed-by: Siddhesh Poyarekar

CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677)

2024-04-25T13:00:45Z

Using alloca matches what other caches do. The request length is bounded by MAXKEYLEN. Reviewed-by: Carlos O'Donell

Update copyright dates not handled by scripts/update-copyrights

2024-01-01T18:53:40Z

I've updated copyright dates in glibc for 2024. This is the patch for the changes not generated by scripts/update-copyrights and subsequent build / regeneration of generated files.

Update copyright dates with scripts/update-copyrights

2024-01-01T18:53:40Z

Move 'netgroup' routines from 'inet' into 'nss'

2023-10-24T10:30:59Z

These netgroup routines are entry points for nss functionality. This commit moves them along with netgroup.h from the 'inet' subdirectory to 'nss', and adjusts any references accordingly. Reviewed-by: Adhemerval Zanella

Remove 'grp' and merge into 'nss' and 'posix'

2023-10-24T10:30:59Z

The majority of grp routines are entry points for nss functionality. This commit removes the 'grp' subdirectory and moves all nss-relevant functionality and all tests to 'nss', and the 'setgroups' stub into 'posix' (alongside the 'getgroups' stub). References to grp/ are accordingly changed. In addition, compat-initgroups.c, a fallback implementation of initgroups is renamed to initgroups-fallback.c so that the build system does not confuse it for nss_compat/compat-initgroups.c. Build time improves very slightly; e.g. down from an average of 45.5s to 44.5s on an 8-thread mobile x86_64 CPU. Reviewed-by: Adhemerval Zanella