Author: rmacklem
Date: Tue Jun  9 05:01:23 2020
New Revision: 361956
URL: https://svnweb.freebsd.org/changeset/base/361956

Log:
  Fix a bug where XU_NGROUPS + 1 groups might be copied.
  
  r361780 fixed the code so that it would only remove the duplicate when
  it actually existed. However, that might have resulted in XU_NGROUPS + 1
  groups being copied, running off the end of the array. This patch fixes
  the problem.
  
  Spotted during code inspection for other mountd changes.
  
  MFC after:    2 weeks

Modified:
  head/usr.sbin/mountd/mountd.c

Modified: head/usr.sbin/mountd/mountd.c
==============================================================================
--- head/usr.sbin/mountd/mountd.c       Tue Jun  9 02:07:43 2020        
(r361955)
+++ head/usr.sbin/mountd/mountd.c       Tue Jun  9 05:01:23 2020        
(r361956)
@@ -3481,6 +3481,8 @@ parsecred(char *namelist, struct xucred *cr)
                                cr->cr_groups[cnt - 1] = groups[cnt];
                } else {
                        cr->cr_ngroups = ngroups;
+                       if (cr->cr_ngroups > XU_NGROUPS)
+                               cr->cr_ngroups = XU_NGROUPS;
                        for (cnt = 1; cnt < ngroups; cnt++)
                                cr->cr_groups[cnt] = groups[cnt];
                }
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to