svn commit: r361956 - head/usr.sbin/mountd
Rick Macklem
rmacklem at FreeBSD.org
Tue Jun 9 05:01:23 UTC 2020
Author: rmacklem
Date: Tue Jun 9 05:01:23 2020
New Revision: 361956
URL: https://svnweb.freebsd.org/changeset/base/361956
Log:
Fix a bug where XU_NGROUPS + 1 groups might be copied.
r361780 fixed the code so that it would only remove the duplicate when
it actually existed. However, that might have resulted in XU_NGROUPS + 1
groups being copied, running off the end of the array. This patch fixes
the problem.
Spotted during code inspection for other mountd changes.
MFC after: 2 weeks
Modified:
head/usr.sbin/mountd/mountd.c
Modified: head/usr.sbin/mountd/mountd.c
==============================================================================
--- head/usr.sbin/mountd/mountd.c Tue Jun 9 02:07:43 2020 (r361955)
+++ head/usr.sbin/mountd/mountd.c Tue Jun 9 05:01:23 2020 (r361956)
@@ -3481,6 +3481,8 @@ parsecred(char *namelist, struct xucred *cr)
cr->cr_groups[cnt - 1] = groups[cnt];
} else {
cr->cr_ngroups = ngroups;
+ if (cr->cr_ngroups > XU_NGROUPS)
+ cr->cr_ngroups = XU_NGROUPS;
for (cnt = 1; cnt < ngroups; cnt++)
cr->cr_groups[cnt] = groups[cnt];
}
More information about the svn-src-head
mailing list