Date: Mon, 16 Apr 2018 19:21:59 +0800 From: Julian Elischer <julian@freebsd.org> To: Konstantin Belousov <kostikbel@gmail.com>, Andriy Gapon <avg@FreeBSD.org> Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r332559 - head/usr.sbin/mountd Message-ID: <5e754f1f-9688-884a-cddd-fa4b65e67f0b@freebsd.org> In-Reply-To: <20180416105611.GG1774@kib.kiev.ua> References: <201804160917.w3G9HaCN081290@repo.freebsd.org> <20180416105611.GG1774@kib.kiev.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
On 16/4/18 6:56 pm, Konstantin Belousov wrote: > On Mon, Apr 16, 2018 at 09:17:36AM +0000, Andriy Gapon wrote: >> Author: avg >> Date: Mon Apr 16 09:17:36 2018 >> New Revision: 332559 >> URL: https://svnweb.freebsd.org/changeset/base/332559 >> >> Log: >> mountd: fix a crash when getgrouplist reports too many groups >> >> Previously the code only warned about the condition and then happily >> proceeded to use the too large value resulting in the array >> out-of-bounds access. >> >> Obtained from: Panzura (Chuanbo Zheng) >> MFC after: 10 days >> Sponsored by: Panzura >> >> Modified: >> head/usr.sbin/mountd/mountd.c >> >> Modified: head/usr.sbin/mountd/mountd.c >> ============================================================================== >> --- head/usr.sbin/mountd/mountd.c Mon Apr 16 08:41:44 2018 (r332558) >> +++ head/usr.sbin/mountd/mountd.c Mon Apr 16 09:17:36 2018 (r332559) >> @@ -2915,8 +2915,11 @@ parsecred(char *namelist, struct xucred *cr) >> } >> cr->cr_uid = pw->pw_uid; >> ngroups = XU_NGROUPS + 1; >> - if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) >> + if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) { >> syslog(LOG_ERR, "too many groups"); >> + ngroups = XU_NGROUPS + 1; > Why XU_NGROUPS and not the value of sysctl("kern.ngroups") ? valid question.. because that is how many are allocated? it was a "minimally invasive patch".. whoever used XU_NGROUPS before should have fixed it. Having said that, thanks for drawing out attention to it.. will probably fix. > >> + } >> + >> /* >> * Compress out duplicate. >> */ >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5e754f1f-9688-884a-cddd-fa4b65e67f0b>