[Pkg-shadow-devel] login assertion on invalid input

[Nicolas François]

Hello,

On Thu, Jul 14, 2011 at 05:14:20PM +0200, christian.casteyde at free.fr wrote:
> 
>         Under high load I managed to type too quickly and entered an invalid
> input at login prompt on my system. That was a command with a pipe, which
> triggers an assertion in login, causing it to crash:
> 
> login: dmesg | less
> login: loginprompt.c:164: loginprompt: Assertion `wlen == (int) len -1' failed
> 
>         This may be interesting to check, just to see if this kind of input
> cannot be used to get unauthorized access.
> 
>         My kernel uses UTF-8. My system is Slackware64 13.37, which uses util-
> linux 2.19.

The assertion catches the issue and exits cleanly.

When the login name provided on the prompt contain non graphical
characters, login expects environment variables to follow.

	foo VAR=VALUE
In this case, the VAR environment variable will be set to VALUE
	foo VALUE
In this case, the L1 environment variable will be set to VALUE

Could you try to reproduce it by entering "test 1" at a console prompt?
(you may have to do it twice as the first prompt might be from getty)

The assertion is wrong, and what should be checked is only:
	wlen <= (int) len -1
(The assertion could actually be removed)

Thanks in advance,
-- 
Nekral