From owner-svn-src-all@freebsd.org Mon Apr 16 11:22:11 2018 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E243FFA11C6; Mon, 16 Apr 2018 11:22:10 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "vps1.elischer.org", Issuer "CA Cert Signing Authority" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 8094989E9F; Mon, 16 Apr 2018 11:22:10 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from Julian-MBP3.local (220-253-154-11.dyn.iinet.net.au [220.253.154.11]) (authenticated bits=0) by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id w3GBM5hW020092 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Mon, 16 Apr 2018 04:22:07 -0700 (PDT) (envelope-from julian@freebsd.org) Subject: Re: svn commit: r332559 - head/usr.sbin/mountd To: Konstantin Belousov , Andriy Gapon Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org References: <201804160917.w3G9HaCN081290@repo.freebsd.org> <20180416105611.GG1774@kib.kiev.ua> From: Julian Elischer Message-ID: <5e754f1f-9688-884a-cddd-fa4b65e67f0b@freebsd.org> Date: Mon, 16 Apr 2018 19:21:59 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 In-Reply-To: <20180416105611.GG1774@kib.kiev.ua> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Apr 2018 11:22:11 -0000 On 16/4/18 6:56 pm, Konstantin Belousov wrote: > On Mon, Apr 16, 2018 at 09:17:36AM +0000, Andriy Gapon wrote: >> Author: avg >> Date: Mon Apr 16 09:17:36 2018 >> New Revision: 332559 >> URL: https://svnweb.freebsd.org/changeset/base/332559 >> >> Log: >> mountd: fix a crash when getgrouplist reports too many groups >> >> Previously the code only warned about the condition and then happily >> proceeded to use the too large value resulting in the array >> out-of-bounds access. >> >> Obtained from: Panzura (Chuanbo Zheng) >> MFC after: 10 days >> Sponsored by: Panzura >> >> Modified: >> head/usr.sbin/mountd/mountd.c >> >> Modified: head/usr.sbin/mountd/mountd.c >> ============================================================================== >> --- head/usr.sbin/mountd/mountd.c Mon Apr 16 08:41:44 2018 (r332558) >> +++ head/usr.sbin/mountd/mountd.c Mon Apr 16 09:17:36 2018 (r332559) >> @@ -2915,8 +2915,11 @@ parsecred(char *namelist, struct xucred *cr) >> } >> cr->cr_uid = pw->pw_uid; >> ngroups = XU_NGROUPS + 1; >> - if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) >> + if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) { >> syslog(LOG_ERR, "too many groups"); >> + ngroups = XU_NGROUPS + 1; > Why XU_NGROUPS and not the value of sysctl("kern.ngroups") ? valid question.. because that is how many are allocated? it was a "minimally invasive patch".. whoever used XU_NGROUPS before should have fixed it. Having said that, thanks for drawing out attention to it.. will probably fix. > >> + } >> + >> /* >> * Compress out duplicate. >> */ >