Date: Mon, 16 Apr 2018 09:17:36 +0000 (UTC) From: Andriy Gapon <avg@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r332559 - head/usr.sbin/mountd Message-ID: <201804160917.w3G9HaCN081290@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: avg Date: Mon Apr 16 09:17:36 2018 New Revision: 332559 URL: https://svnweb.freebsd.org/changeset/base/332559 Log: mountd: fix a crash when getgrouplist reports too many groups Previously the code only warned about the condition and then happily proceeded to use the too large value resulting in the array out-of-bounds access. Obtained from: Panzura (Chuanbo Zheng) MFC after: 10 days Sponsored by: Panzura Modified: head/usr.sbin/mountd/mountd.c Modified: head/usr.sbin/mountd/mountd.c ============================================================================== --- head/usr.sbin/mountd/mountd.c Mon Apr 16 08:41:44 2018 (r332558) +++ head/usr.sbin/mountd/mountd.c Mon Apr 16 09:17:36 2018 (r332559) @@ -2915,8 +2915,11 @@ parsecred(char *namelist, struct xucred *cr) } cr->cr_uid = pw->pw_uid; ngroups = XU_NGROUPS + 1; - if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) + if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) { syslog(LOG_ERR, "too many groups"); + ngroups = XU_NGROUPS + 1; + } + /* * Compress out duplicate. */
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201804160917.w3G9HaCN081290>