From b3b9fd36ee15611db6e80a868ab6707b37449f34 Mon Sep 17 00:00:00 2001 From: vitalyd Date: Mon, 27 Sep 2021 09:55:59 -0400 Subject: [PATCH] Fix memory unsafety in unistd::getgrouplist Fixes #1541 --- CHANGELOG.md | 3 ++- src/unistd.rs | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f81268a0e5..03d260097d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -91,9 +91,10 @@ This project adheres to [Semantic Versioning](https://semver.org/). - Added more errno definitions for better backwards compatibility with Nix 0.21.0. (#[1467](https://github.com/nix-rust/nix/pull/1467)) - - Fixed potential undefined behavior in `Signal::try_from` on some platforms. (#[1484](https://github.com/nix-rust/nix/pull/1484)) +- Fixed buffer overflow in `unistd::getgrouplist`. + (#[1542](https://github.com/nix-rust/nix/pull/1542)) ### Removed diff --git a/src/unistd.rs b/src/unistd.rs index 64759dc6bd..a9862d37a3 100644 --- a/src/unistd.rs +++ b/src/unistd.rs @@ -1540,8 +1540,7 @@ pub fn getgrouplist(user: &CStr, group: Gid) -> Result> { Ok(None) | Err(_) => ::max_value(), }; use std::cmp::min; - let mut ngroups = min(ngroups_max, 8); - let mut groups = Vec::::with_capacity(ngroups as usize); + let mut groups = Vec::::with_capacity(min(ngroups_max, 8) as usize); cfg_if! { if #[cfg(any(target_os = "ios", target_os = "macos"))] { type getgrouplist_group_t = c_int; @@ -1551,6 +1550,7 @@ pub fn getgrouplist(user: &CStr, group: Gid) -> Result> { } let gid: gid_t = group.into(); loop { + let mut ngroups = groups.capacity() as i32; let ret = unsafe { libc::getgrouplist(user.as_ptr(), gid as getgrouplist_group_t,