user-util: be stricter in parse_uid()

Let's refuse "+" and "-" prefixed UIDs. Let's refuse whitespace-prefixed UIDS, Let's refuse zero-prefixed UIDs. Let's be safe than sorry.
2020-06-05 15:56:31 +02:00
parent c44702a8bd
commit f5979b63cc
2 changed files with 32 additions and 4 deletions
@@ -49,7 +49,15 @@ int parse_uid(const char *s, uid_t *ret) {
        assert(s);

        assert_cc(sizeof(uid_t) == sizeof(uint32_t));
-        r = safe_atou32_full(s, 10, &uid);
+
+        /* We are very strict when parsing UIDs, and prohibit +/- as prefix, leading zero as prefix, and
+         * whitespace. We do this, since this call is often used in a context where we parse things as UID
+         * first, and if that doesn't work we fall back to NSS. Thus we really want to make sure that UIDs
+         * are parsed as UIDs only if they really really look like UIDs. */
+        r = safe_atou32_full(s, 10
+                             | SAFE_ATO_REFUSE_PLUS_MINUS
+                             | SAFE_ATO_REFUSE_LEADING_ZERO
+                             | SAFE_ATO_REFUSE_LEADING_WHITESPACE, &uid);
        if (r < 0)
                return r;