- (djm) [loginrec.c] Check for username truncation when looking up lastlog

entries

ChangeLog

@@ -1,3 +1,7 @@
+20131229
+ - (djm) [loginrec.c] Check for username truncation when looking up lastlog
+   entries
+
 20131221
  - (dtucker) [regress/keytype.sh] Actually test ecdsa key types.
 

loginrec.c

@@ -310,9 +310,12 @@ login_get_lastlog(struct logininfo *li, const uid_t uid)
 		fatal("%s: Cannot find account for uid %ld", __func__,
 		    (long)uid);
 
-	/* No MIN_SIZEOF here - we absolutely *must not* truncate the
-	 * username (XXX - so check for trunc!) */
-	strlcpy(li->username, pw->pw_name, sizeof(li->username));
+	if (strlcpy(li->username, pw->pw_name, sizeof(li->username)) >=
+	    sizeof(li->username)) {
+		error("%s: username too long (%lu > max %lu)", __func__,
+		    strlen(pw->pw_name), sizeof(li->username) - 1);
+		return NULL;
+	}
 
 	if (getlast_entry(li))
 		return (li);
@@ -320,7 +323,6 @@ login_get_lastlog(struct logininfo *li, const uid_t uid)
 		return (NULL);
 }
 
-
 /*
  * login_alloc_entry(int, char*, char*, char*)    - Allocate and initialise
  *                                                  a logininfo structure