Possible buffer underflow

[VoroninArtemii]

There may be buffer underflow:

nss-pam-ldapd/nslcd/passwd.c

Line 544 in 9a353ac

attmap_get_value(entry, attmap_passwd_gecos, gecos, sizeof(gecos));

We have two checks before accessing the array buffer by index in the function attmap_get_value. And they are false because const char *attmap_passwd_gecos = "\"${gecos:-$cn}\"". This is the variable attr.

nss-pam-ldapd/nslcd/attmap.c

Line 272 in 9a353ac

if (attr[0] != '"')

nss-pam-ldapd/nslcd/attmap.c

Lines 289 to 290 in 9a353ac

	if ((attr[strlen(attr) - 1] != '"') ||
	(expr_parse(attr + 1, buffer, buflen, entry_expand, (void *)entry) == NULL))

But after that we try to access the array by index -1:

nss-pam-ldapd/nslcd/attmap.c

Line 297 in 9a353ac

if (buffer[strlen(buffer) - 1] == '"')

Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author A. Voronin.