Re: [patch] groups: integer underflow in groups_alloc()

2015-02-23 Thread J. Bruce Fields
On Mon, Feb 23, 2015 at 09:03:27PM +0300, Dan Carpenter wrote: > On Mon, Feb 23, 2015 at 11:10:02AM -0600, Eric W. Biederman wrote: > > Dan Carpenter writes: > > > > > This is called from rsc_parse() with a use controlled value. Say for > > > example that "gidsetsize" is negative, then we could

Re: [patch] groups: integer underflow in groups_alloc()

2015-02-23 Thread Eric W. Biederman
Dan Carpenter writes: > On Mon, Feb 23, 2015 at 11:10:02AM -0600, Eric W. Biederman wrote: >> Dan Carpenter writes: >> >> > This is called from rsc_parse() with a use controlled value. Say for >> > example that "gidsetsize" is negative, then we could end up allocating >> > less than sizeof(str

Re: [patch] groups: integer underflow in groups_alloc()

2015-02-23 Thread Dan Carpenter
On Mon, Feb 23, 2015 at 11:10:02AM -0600, Eric W. Biederman wrote: > Dan Carpenter writes: > > > This is called from rsc_parse() with a use controlled value. Say for > > example that "gidsetsize" is negative, then we could end up allocating > > less than sizeof(struct group_info) leading to memo

Re: [patch] groups: integer underflow in groups_alloc()

2015-02-23 Thread Eric W. Biederman
Dan Carpenter writes: > This is called from rsc_parse() with a use controlled value. Say for > example that "gidsetsize" is negative, then we could end up allocating > less than sizeof(struct group_info) leading to memory corruption. Right now it is the responsibility of the caller of groups_al

[patch] groups: integer underflow in groups_alloc()

2015-02-23 Thread Dan Carpenter
This is called from rsc_parse() with a use controlled value. Say for example that "gidsetsize" is negative, then we could end up allocating less than sizeof(struct group_info) leading to memory corruption. Signed-off-by: Dan Carpenter --- I copied the NGROUPS_MAX limit from the surrounding code,