bug in yppasswd

[Chris Elvin]

Dimitri Konstantas mentioned a bug in yppasswd (v7n17).  We have also
discovered this and another bug in the yellow pages system.  Our bug
concerns the the function innetgr() which tests whether a user is in a
particular net group or not.  We have the situation shown below:

user name    net group name

ee87jjs        ise87
ee87jjs1    beng87

innetgr() matches users using strncmp() on the user name with strlen(user
name) as the length parameter and does not check that further characters
may be present in the yellow pages entry.  This also occurs when trying to
match domain and machine names in innetgr().

Thus innetgr() shows user ee87jjs is in both beng87 and ise87 net groups.
I have made a patch to the innetgr() function which overcomes this which I
have mailed to sun-spots.

I have not had time to investigate yppasswd itself but someone should
start shouting at SUN since this is potentially a minefield.  Has anybody
got a patch for the rest of yellow pages cause I suspect that this bug
occurs all over yellow pages.

Christopher Elvin,               Network Address : celvin at ee.surrey.ac.uk
Dept. of Electronic and          Telephone       : +44 483 571281  ext. 9104
   Electrical Engineering        Direct line     : +44 483 509104
University of Surrey,            Telex           : +44 859331
Guildford,                       Fax             : +44 483 300803
Surrey, GU2 5XH.