>Number: 161510
>Category: misc
>Synopsis: usr.bin/newgrp has a memory leak
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Oct 12 00:20:03 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator: Jeremy Huddleston
>Release: HEAD
>Organization:
Apple Inc
>Environment:
NA
>Description:
version 1.3 added support for variable _SC_NGROUPS_MAX by mallocing the array,
but the array is not freed on errors.
>How-To-Repeat:
>Fix:
Index: newgrp.c
===================================================================
--- newgrp.c (revision 3271)
+++ newgrp.c (working copy)
@@ -217,7 +217,7 @@
err(1, "malloc");
if ((ngrps = getgroups(ngrps_max, (gid_t *)grps)) < 0) {
warn("getgroups");
- return;
+ goto end;
}
/* Remove requested gid from supp. list if it exists. */
@@ -231,7 +231,7 @@
if (setgroups(ngrps, (const gid_t *)grps) < 0) {
PRIV_END;
warn("setgroups");
- return;
+ goto end;
}
PRIV_END;
}
@@ -240,7 +240,7 @@
if (setgid(grp->gr_gid)) {
PRIV_END;
warn("setgid");
- return;
+ goto end;
}
PRIV_END;
grps[0] = grp->gr_gid;
@@ -255,12 +255,13 @@
if (setgroups(ngrps, (const gid_t *)grps)) {
PRIV_END;
warn("setgroups");
- return;
+ goto end;
}
PRIV_END;
}
}
+end:
free(grps);
}
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
