changeset 12416:804bf8e8efd3

mgetgroups: do not write bytes beyond end of malloc'd buffer * lib/mgetgroups.c: Fix an off-by-one error. When we have no username, we call getgroups with a one-element-shorter buffer, but still told it the length was original, max_n_groups.
author Jim Meyering <meyering@redhat.com>
date Thu, 10 Dec 2009 12:17:19 +0100
parents 8f89d8947295
children e09c73938d46
files ChangeLog lib/mgetgroups.c
diffstat 2 files changed, 9 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2009-12-10  Jim Meyering  <meyering@redhat.com>
+
+	mgetgroups: do not write bytes beyond end of malloc'd buffer
+	* lib/mgetgroups.c: Fix an off-by-one error.  When we have no
+	username, we call getgroups with a one-element-shorter buffer,
+	but still told it the length was original, max_n_groups.
+
 2009-12-09  Eric Blake  <ebb9@byu.net>
 
 	cloexec: relax license
--- a/lib/mgetgroups.c
+++ b/lib/mgetgroups.c
@@ -141,7 +141,8 @@
 
   ng = (username
         ? getugroups (max_n_groups, g, username, gid)
-        : getgroups (max_n_groups, g + (gid != (gid_t) -1)));
+        : getgroups (max_n_groups - (gid != (gid_t) -1),
+                                g + (gid != (gid_t) -1)));
 
   if (ng < 0)
     {