diff options
| author | vitalyd <vitalyd@gmail.com> | 2021-09-27 09:55:59 -0400 |
|---|---|---|
| committer | Alan Somers <asomers@gmail.com> | 2021-09-28 19:06:52 -0600 |
| commit | 1671edc3e7d3fea63fbf721071bd2ddbad8e9e67 (patch) | |
| tree | f380df87b8965e37a7d5c7e908b39d9047f01758 | |
| parent | 9a2f86f4cf9bddefc1878a124b4ee6f83e6ef064 (diff) | |
| download | nix-1671edc3e7d3fea63fbf721071bd2ddbad8e9e67.zip | |
Fix memory unsafety in unistd::getgrouplist
Fixes #1541
| -rw-r--r-- | CHANGELOG.md | 3 | ||||
| -rw-r--r-- | src/unistd.rs | 4 |
2 files changed, 4 insertions, 3 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index f81268a0..ec3dc7c3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -91,9 +91,10 @@ This project adheres to [Semantic Versioning](https://semver.org/). - Added more errno definitions for better backwards compatibility with Nix 0.21.0. (#[1467](https://github.com/nix-rust/nix/pull/1467)) - - Fixed potential undefined behavior in `Signal::try_from` on some platforms. (#[1484](https://github.com/nix-rust/nix/pull/1484)) +- Fixed buffer overflow in `unistd::getgrouplist`. + (#[1545](https://github.com/nix-rust/nix/pull/1545)) ### Removed diff --git a/src/unistd.rs b/src/unistd.rs index 64759dc6..a9862d37 100644 --- a/src/unistd.rs +++ b/src/unistd.rs @@ -1540,8 +1540,7 @@ pub fn getgrouplist(user: &CStr, group: Gid) -> Result<Vec<Gid>> { Ok(None) | Err(_) => <c_int>::max_value(), }; use std::cmp::min; - let mut ngroups = min(ngroups_max, 8); - let mut groups = Vec::<Gid>::with_capacity(ngroups as usize); + let mut groups = Vec::<Gid>::with_capacity(min(ngroups_max, 8) as usize); cfg_if! { if #[cfg(any(target_os = "ios", target_os = "macos"))] { type getgrouplist_group_t = c_int; @@ -1551,6 +1550,7 @@ pub fn getgrouplist(user: &CStr, group: Gid) -> Result<Vec<Gid>> { } let gid: gid_t = group.into(); loop { + let mut ngroups = groups.capacity() as i32; let ret = unsafe { libc::getgrouplist(user.as_ptr(), gid as getgrouplist_group_t, |