allbery@ncoast.UUCP (08/04/86)
Quoted from <4@talcott.HARVARD.EDU> ["Re: bug in UNaXcess "getuser()" [user.c]"], by gst@talcott.HARVARD.EDU (Gary S. Trujillo)... +--------------- | Oops. I found a problem with UNaXcess, but I got the fix wrong. It has | to do with a case in which the "userfile" has an entry which is matched | in getuser() which has too few colons. I believe that the test at line | 51 should read: | | if (ncolon < 6) { | | Otherwise, an entry with fewer than 6 colons would be allowed, and one | of the for loops in the code that follows could go into a long search | through memory looking for a colon, clobbering various things as it goes. +--------------- The ncolon < 5 code was there to ease translation for the (very few) sites running UNaXcess 0.4.2; the case of 5 colons was correctly trapped, and as users logged in their password entries would be translated to the new format. (0.4.2 didn't have login conferences, so there were only 6 userfile fields.) BTW, the \n vs. : shoudl have been caught later in the code; I did it that way so it'd be easier to add new userfile fields. I have been delinting as I go, but this is the last version I intend to post using current source, as I am again attempting a rewrite. (The big problem is that the next mods to UNaXcess require some form of ISAM for reasonable speed -- you've no doubt noticed it's a bit slow scanning directories, unless you run 4.2 where the directory mungiung is in the kernel. Unfortunately, I'm only slowly figuring out ISAM techniques.) BTW, for those who got bad shars -- the initial post was a kludge. So I'm going to repost all of UNaXcess. ++Brandon -- ---------------- /--/ Brandon S. Allbery UUCP: decvax!cwruecmp! / / /|\/ Tridelta Industries, Inc. ncoast!tdi2!brandon ---- -------- /-++ 7350 Corporate Blvd. PHONE: +1 216 974 9210 / / /---, ---- Mentor, Ohio 44060 SYSOP: UNaXcess/ncoast / / / / / / -- HOME -- (216) 781-6201 24 hrs. / / / / / / 6615 Center St. Apt. A1-105 ARPA: ncoast!allbery% ---- -----~ ---- Mentor, Ohio 44060-4101 case.CSNET@csnet-relay