Skip to content

Commit 497cbf1

Browse files
src/newusers.c: A user/group name with a leading digit is valid
Only consider a string to be a UID/GID if it is all digits. Here's a reproducer of the bug: $ echo 'foo:p::1a::/tmp/nonexistent:/usr/bin/false' > x $ sudo newusers ./x newusers: invalid group ID '1a' newusers: line 1: can't create group Where the expected behavior would be the same as for a group name that doesn't start with a digit: $ echo 'foo:p::a1a::/tmp/nonexistent:/usr/bin/false' > x $ sudo newusers ./x $ tail -n1 /etc/group a1a:x:1004: $ tail -n1 /etc/passwd foo:x:1004:1004::/tmp/nonexistent:/usr/bin/false Closes: <#1474> Signed-off-by: Alejandro Colomar <alx@kernel.org>
1 parent d7ce7e8 commit 497cbf1

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

src/newusers.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@
5656
#include "shadow/gshadow/sgrp.h"
5757
#include "shadowlog.h"
5858
#include "sssd.h"
59+
#include "string/ctype/strisascii/strisdigit.h"
5960
#include "string/sprintf/snprintf.h"
6061
#include "string/strcmp/streq.h"
6162
#include "string/strdup/strdup.h"
@@ -248,7 +249,7 @@ static int add_group (const char *name, const char *gid, gid_t *ngid, uid_t uid)
248249
return 0;
249250
}
250251

251-
if (isdigit (gid[0])) {
252+
if (!streq(gid, "") && strisdigit(gid)) {
252253
/*
253254
* The GID is a number, which means either this is a brand
254255
* new group, or an existing group.
@@ -292,7 +293,7 @@ static int add_group (const char *name, const char *gid, gid_t *ngid, uid_t uid)
292293
/*
293294
* Now I have all of the fields required to create the new group.
294295
*/
295-
if (!streq(gid, "") && (!isdigit(gid[0]))) {
296+
if (!streq(gid, "") && !strisdigit(gid)) {
296297
grent.gr_name = xstrdup (gid);
297298
} else {
298299
grent.gr_name = xstrdup (name);
@@ -357,7 +358,7 @@ static int get_user_id (const char *uid, uid_t *nuid) {
357358
* The first guess for the UID is either the numerical UID that the
358359
* caller provided, or the next available UID.
359360
*/
360-
if (isdigit (uid[0])) {
361+
if (!streq(uid, "") && strisdigit(uid)) {
361362
if ((get_uid(uid, nuid) == -1) || (*nuid == (uid_t)-1)) {
362363
fprintf (stderr,
363364
_("%s: invalid user ID '%s'\n"),

0 commit comments

Comments
 (0)