svn commit: r332559 - head/usr.sbin/mountd

[Andriy Gapon]

Author: avg
Date: Mon Apr 16 09:17:36 2018
New Revision: 332559
URL: https://svnweb.freebsd.org/changeset/base/332559

Log:
  mountd: fix a crash when getgrouplist reports too many groups
  
  Previously the code only warned about the condition and then happily
  proceeded to use the too large value resulting in the array
  out-of-bounds access.
  
  Obtained from:	Panzura (Chuanbo Zheng)
  MFC after:	10 days
  Sponsored by:	Panzura

Modified:
  head/usr.sbin/mountd/mountd.c

Modified: head/usr.sbin/mountd/mountd.c
==============================================================================
--- head/usr.sbin/mountd/mountd.c	Mon Apr 16 08:41:44 2018	(r332558)
+++ head/usr.sbin/mountd/mountd.c	Mon Apr 16 09:17:36 2018	(r332559)
@@ -2915,8 +2915,11 @@ parsecred(char *namelist, struct xucred *cr)
 		}
 		cr->cr_uid = pw->pw_uid;
 		ngroups = XU_NGROUPS + 1;
-		if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups))
+		if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups)) {
 			syslog(LOG_ERR, "too many groups");
+			ngroups = XU_NGROUPS + 1;
+		}
+
 		/*
 		 * Compress out duplicate.
 		 */