Bogus parsing in lib/limits.c:setup_limits()

[alejandro-colomar]

shadow/lib/limits.c

Lines 467 to 520 in 0983531

	for (cp = info->pw_gecos; cp != NULL; cp = strchr (cp, ',')) {
	char *val;
	cp = strprefix(cp, ",") ?: cp;
	val = strprefix(cp, "pri=");
	if (val != NULL) {
	int inc;
	if (a2si(&inc, val, NULL, 0, -20, 20) == 0) {
	errno = 0;
	if ( (nice (inc) != -1)
	|| (0 != errno)) {
	continue;
	}
	}
	/* Failed to parse or failed to nice() */
	SYSLOG(LOG_WARN,
	"Can't set the nice value for user %s",
	info->pw_name);
	continue;
	}
	val = strprefix(cp, "ulimit=");
	if (val != NULL) {
	int blocks;
	if ( (str2si(&blocks, val) == -1)
	|| (set_filesize_limit (blocks) != 0)) {
	SYSLOG(LOG_WARN,
	"Can't set the ulimit for user %s",
	info->pw_name);
	}
	continue;
	}
	val = strprefix(cp, "umask=");
	if (val != NULL) {
	mode_t mask;
	if (str2i(mode_t, &mask, val) == -1) {
	SYSLOG(LOG_WARN,
	"Can't set umask value for user %s",
	info->pw_name);
	} else {
	(void) umask (mask);
	}
	continue;
	}
	}
	}

Does it make any sense to continue after successfully parsing a number?

If the functions that parse a number succeed (return 0), they have parsed the entire string. Otherwise, they would have failed with ENOTSUP, which means that there was trailing text after the number.

I revised the history of this file and the history of the functions that parse numbers, and I believe this has been the behavior always (not a regression). Thus, I suspect this code doesn't work as expected.

Cc: @ikerexxe , @hallyn , @stoeckmann