Re: <shadow.h> function: fgetspent_r

[Markus Wichmann <nullplan@gmx.net>]

Hi all,

so I had a look at the glibc implementation (from v2.24, which I had
lying around), and here are my findings: They don't return on format
error. Instead, they loop.

On buffer too short, they will leave the stream where it is and return
ERANGE. And on end of file, they return ENOENT, which I find bizarre.

Looking at my own implementation, I am not certain if cleaning up a
faulty state is desirable, since non-recoverable situations exist.
fgetspent_r() has the invariant that the file position is pointing to
the start of a line. So, first thought was to use ftell() beforehand and
fseek() on error, to revert to the start of a line. However, that really
only helps with the "buffer too short" case. An illegal line won't
become more acceptable, no matter how many times we reread it.

Rich correctly pointed out that a file might not be seekable. So if
reversing isn't an option, we can only go forward. So I added an fgets()
loop in case the fseek() fails. But fgets() can fail, too. Maybe even
spuriously (what happens if the file is actually an fdopen()ed
nonblocking TCP socket or something?), so that the problem fixes itself.
Then the invariant is still violated and we have no indication of
anything being wrong.

So, since it is impossible to guarantee the invariant, and the user
certainly has no way to check, I think telling the user to close the
file on any error is probably the best choice here (i.e. the choice that
saves me the most work).

Looping on format error sounds attractive as well, but I think we'd want
that behavior to be consistent across the entire src/passwd directory,
right? It would allow slightly broken files to be present in the system
without bricking it. On the other hand, permissivity is usually only a
good thing outside of security contexts.

Thoughts?

Ciao,
Markus