From 63b78d003bd8ca111a736e6cea6333da50f5f09b Mon Sep 17 00:00:00 2001 From: "dtucker@openbsd.org" Date: Mon, 22 Jun 2015 12:29:57 +0000 Subject: upstream commit Don't call setgroups if we have zero groups; there's no guarantee that it won't try to deref the pointer. Based on a patch from mail at quitesimple.org, ok djm deraadt Upstream-ID: 2fff85e11d7a9a387ef7fddf41fbfaf566708ab1 --- uidswap.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'uidswap.c') diff --git a/uidswap.c b/uidswap.c index f2713fdb..27a2faa6 100644 --- a/uidswap.c +++ b/uidswap.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uidswap.c,v 1.37 2015/01/16 06:40:12 deraadt Exp $ */ +/* $OpenBSD: uidswap.c,v 1.38 2015/06/22 12:29:57 dtucker Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -113,7 +113,7 @@ temporarily_use_uid(struct passwd *pw) } } /* Set the effective uid to the given (unprivileged) uid. */ - if (setgroups(user_groupslen, user_groups) < 0) + if (user_groupslen > 0 && setgroups(user_groupslen, user_groups) < 0) fatal("setgroups: %.100s", strerror(errno)); #ifndef SAVED_IDS_WORK_WITH_SETEUID /* Propagate the privileged gid to all of our gids. */ @@ -187,7 +187,8 @@ restore_uid(void) setgid(getgid()); #endif /* SAVED_IDS_WORK_WITH_SETEUID */ - if (setgroups(saved_egroupslen, saved_egroups) < 0) + if (saved_egroupslen > 0 && + setgroups(saved_egroupslen, saved_egroups) < 0) fatal("setgroups: %.100s", strerror(errno)); temporarily_use_uid_effective = 0; } -- cgit v1.2.1