mirror of
https://github.com/docker/cli.git
synced 2026-11-12 15:53:52 -04:00
Sebastiaan van Stijn
8fda97b545
- user: prevent possible DoS via unbounded parsing of user and group database files in GHSA-mjcv-p78q-w5fw. This fixes a similar issue as CVE-2026-47262 in containerd. - user: prevent falling back to looking up numeric usernames Improve handling of numeric user/group to prevent looking up numeric values as usernames. This fixes a similar issue as [CVE-2026-46680] in containerd. - user: update minimum go version to go1.18 - assorted testing and linting fixes. [CVE-2026-46680]: https://github.com/advisories/GHSA-fqw6-gf59-qr4w full diff: https://github.com/moby/sys/compare/user/v0.4.0...user/v0.4.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
43 lines
764 B
Go
43 lines
764 B
Go
//go:build gofuzz
|
|
|
|
package user
|
|
|
|
import (
|
|
"io"
|
|
"strings"
|
|
)
|
|
|
|
func IsDivisbleBy(n int, divisibleby int) bool {
|
|
return (n % divisibleby) == 0
|
|
}
|
|
|
|
func FuzzUser(data []byte) int {
|
|
if len(data) == 0 {
|
|
return -1
|
|
}
|
|
if !IsDivisbleBy(len(data), 5) {
|
|
return -1
|
|
}
|
|
|
|
var divided [][]byte
|
|
|
|
chunkSize := len(data) / 5
|
|
|
|
for i := 0; i < len(data); i += chunkSize {
|
|
end := i + chunkSize
|
|
|
|
divided = append(divided, data[i:end])
|
|
}
|
|
|
|
_, _ = ParsePasswdFilter(strings.NewReader(string(divided[0])), nil)
|
|
|
|
var passwd, group io.Reader
|
|
|
|
group = strings.NewReader(string(divided[1]))
|
|
_, _ = GetAdditionalGroups([]string{string(divided[2])}, group)
|
|
|
|
passwd = strings.NewReader(string(divided[3]))
|
|
_, _ = GetExecUser(string(divided[4]), nil, passwd, group)
|
|
return 1
|
|
}
|