Re: #1787: current-user-id setter from (chicken process-context posix) maybe needs some argument validation

[elf]

This may actually be a more serious bug than it looks like, for setuid  
programmes, eg if someone passes, say, a null pointer, or a pointer aligned to 
wrapping values.

The code isn't even doing type checking to make sure it's getting an int (well, 
uid_t). It's doing pointer conversion when it shouldn't be.

-elf

On 24 September 2021 07:59:37 GMT+03:00, Chicken Trac <mario.goulart@gmail.com> 
wrote:
>#1787: current-user-id setter from (chicken process-context posix) maybe needs
>some argument validation
>--------------------------------------------+----------------------------
>            Reporter:  Christopher Brannon  |       Type:  defect
>              Status:  new                  |   Priority:  minor
>           Milestone:  someday              |  Component:  core libraries
>             Version:  5.2.0                |   Keywords:
>Estimated difficulty:                       |
>--------------------------------------------+----------------------------
> {{{
> #;2> (set! (current-user-id) "abracadabra")
> #;3> (current-user-id)
> 2245824928
> }}}
>
> This should fail with an error rather than setting the uid to a bogus
> value.
> Maybe the current-user-id setter could be made to take a string and do a
> uid lookup, but that's a discussion for another day.
>
>-- 
>Ticket URL: <https://bugs.call-cc.org/ticket/1787>
>CHICKEN Scheme <https://www.call-cc.org/>
>CHICKEN Scheme is a compiler for the Scheme programming language.