Date: Mon, 16 Apr 2018 13:56:11 +0300 From: Konstantin Belousov <kostikbel@gmail.com> To: Andriy Gapon <avg@FreeBSD.org> Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r332559 - head/usr.sbin/mountd Message-ID: <20180416105611.GG1774@kib.kiev.ua> In-Reply-To: <201804160917.w3G9HaCN081290@repo.freebsd.org> References: <201804160917.w3G9HaCN081290@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Apr 16, 2018 at 09:17:36AM +0000, Andriy Gapon wrote: > Author: avg > Date: Mon Apr 16 09:17:36 2018 > New Revision: 332559 > URL: https://svnweb.freebsd.org/changeset/base/332559 > > Log: > mountd: fix a crash when getgrouplist reports too many groups > > Previously the code only warned about the condition and then happily > proceeded to use the too large value resulting in the array > out-of-bounds access. > > Obtained from: Panzura (Chuanbo Zheng) > MFC after: 10 days > Sponsored by: Panzura > > Modified: > head/usr.sbin/mountd/mountd.c > > Modified: head/usr.sbin/mountd/mountd.c > ============================================================================== > --- head/usr.sbin/mountd/mountd.c Mon Apr 16 08:41:44 2018 (r332558) > +++ head/usr.sbin/mountd/mountd.c Mon Apr 16 09:17:36 2018 (r332559) > @@ -2915,8 +2915,11 @@ parsecred(char *namelist, struct xucred *cr) > } > cr->cr_uid = pw->pw_uid; > ngroups = XU_NGROUPS + 1; > - if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) > + if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) { > syslog(LOG_ERR, "too many groups"); > + ngroups = XU_NGROUPS + 1; Why XU_NGROUPS and not the value of sysctl("kern.ngroups") ? > + } > + > /* > * Compress out duplicate. > */
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20180416105611.GG1774>