Author: avg Date: Mon Apr 16 09:17:36 2018 New Revision: 332559 URL: https://svnweb.freebsd.org/changeset/base/332559
Log: mountd: fix a crash when getgrouplist reports too many groups Previously the code only warned about the condition and then happily proceeded to use the too large value resulting in the array out-of-bounds access. Obtained from: Panzura (Chuanbo Zheng) MFC after: 10 days Sponsored by: Panzura Modified: head/usr.sbin/mountd/mountd.c Modified: head/usr.sbin/mountd/mountd.c ============================================================================== --- head/usr.sbin/mountd/mountd.c Mon Apr 16 08:41:44 2018 (r332558) +++ head/usr.sbin/mountd/mountd.c Mon Apr 16 09:17:36 2018 (r332559) @@ -2915,8 +2915,11 @@ parsecred(char *namelist, struct xucred *cr) } cr->cr_uid = pw->pw_uid; ngroups = XU_NGROUPS + 1; - if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) + if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) { syslog(LOG_ERR, "too many groups"); + ngroups = XU_NGROUPS + 1; + } + /* * Compress out duplicate. */ _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"