[src/trunk]: src/usr.bin/su After a ':' (as in login:group or just :group) in...

[kre <kre%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/3937a6273c04
branches:  trunk
changeset: 374018:3937a6273c04
user:      kre <kre%NetBSD.org@localhost>
date:      Fri Mar 24 16:58:24 2023 +0000

description:
After a ':' (as in login:group or just :group) insist that there
actually be a group name (of some form, don't care what) present.

diffstat:

 usr.bin/su/su.c     |  9 +++++----
 usr.bin/su/su_pam.c |  9 +++++----
 2 files changed, 10 insertions(+), 8 deletions(-)

diffs (60 lines):

diff -r 8b14d0b9e948 -r 3937a6273c04 usr.bin/su/su.c
--- a/usr.bin/su/su.c   Fri Mar 24 14:34:17 2023 +0000
+++ b/usr.bin/su/su.c   Fri Mar 24 16:58:24 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: su.c,v 1.74 2021/10/30 11:25:30 nia Exp $      */
+/*     $NetBSD: su.c,v 1.75 2023/03/24 16:58:24 kre Exp $      */
 
 /*
  * Copyright (c) 1988 The Regents of the University of California.
@@ -39,7 +39,7 @@
 #if 0
 static char sccsid[] = "@(#)su.c       8.3 (Berkeley) 4/2/94";*/
 #else
-__RCSID("$NetBSD: su.c,v 1.74 2021/10/30 11:25:30 nia Exp $");
+__RCSID("$NetBSD: su.c,v 1.75 2023/03/24 16:58:24 kre Exp $");
 #endif
 #endif /* not lint */
 
@@ -210,8 +210,9 @@ main(int argc, char **argv)
        if ((p = strchr(user, ':')) != NULL) {
                *p = '\0';
                gname = ++p;
-       }
-       else
+               if (*gname == '\0')
+                       errx(EXIT_FAILURE, "missing 'group' after ':'");
+       } else
                gname = NULL;
 
 #ifdef ALLOW_EMPTY_USER
diff -r 8b14d0b9e948 -r 3937a6273c04 usr.bin/su/su_pam.c
--- a/usr.bin/su/su_pam.c       Fri Mar 24 14:34:17 2023 +0000
+++ b/usr.bin/su/su_pam.c       Fri Mar 24 16:58:24 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: su_pam.c,v 1.23 2021/11/27 22:16:42 rillig Exp $       */
+/*     $NetBSD: su_pam.c,v 1.24 2023/03/24 16:58:24 kre Exp $  */
 
 /*
  * Copyright (c) 1988 The Regents of the University of California.
@@ -39,7 +39,7 @@
 #if 0
 static char sccsid[] = "@(#)su.c       8.3 (Berkeley) 4/2/94";*/
 #else
-__RCSID("$NetBSD: su_pam.c,v 1.23 2021/11/27 22:16:42 rillig Exp $");
+__RCSID("$NetBSD: su_pam.c,v 1.24 2023/03/24 16:58:24 kre Exp $");
 #endif
 #endif /* not lint */
 
@@ -204,8 +204,9 @@ main(int argc, char **argv)
        if ((p = strchr(user, ':')) != NULL) {
                *p = '\0';
                gname = ++p;
-       }
-       else
+               if (*gname == '\0')
+                       errx(EXIT_FAILURE, "missing 'group' after ':'");
+       } else
                gname = NULL;
 
 #ifdef ALLOW_EMPTY_USER