mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-13 06:33:44 +01:00
Fix insanely large stack_allocation in log_credential_status
I'm not one to insist on C's miserly stack limits, but allocating a 256K array on the stack is too much even for me. Bugfix on 0.2.1.7-alpha. Found by coverity. Fixes CID # 450.
This commit is contained in:
parent
010b8dd4f6
commit
d25feadebb
5
changes/cid_450
Normal file
5
changes/cid_450
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
o Minor bugfixes:
|
||||||
|
- Don't stack-allocate the list of supplementary GIDs when we're
|
||||||
|
about to log them. Stack-allocating NGROUPS_MAX gid_t elements
|
||||||
|
could take up to 256K, which is way too much stack. Found by
|
||||||
|
Coverity; CID #450. Bugfix on 0.2.1.7-alpha.
|
@ -1080,7 +1080,8 @@ log_credential_status(void)
|
|||||||
/* Read, effective and saved GIDs */
|
/* Read, effective and saved GIDs */
|
||||||
gid_t rgid, egid, sgid;
|
gid_t rgid, egid, sgid;
|
||||||
/* Supplementary groups */
|
/* Supplementary groups */
|
||||||
gid_t sup_gids[NGROUPS_MAX + 1];
|
gid_t *sup_gids = NULL;
|
||||||
|
int sup_gids_size;
|
||||||
/* Number of supplementary groups */
|
/* Number of supplementary groups */
|
||||||
int ngids;
|
int ngids;
|
||||||
|
|
||||||
@ -1126,9 +1127,19 @@ log_credential_status(void)
|
|||||||
#endif
|
#endif
|
||||||
|
|
||||||
/* log supplementary groups */
|
/* log supplementary groups */
|
||||||
if ((ngids = getgroups(NGROUPS_MAX + 1, sup_gids)) < 0) {
|
sup_gids_size = 64;
|
||||||
|
sup_gids = tor_malloc(sizeof(gid_t) * 64);
|
||||||
|
while ((ngids = getgroups(sup_gids_size, sup_gids)) < 0 &&
|
||||||
|
errno == EINVAL &&
|
||||||
|
sup_gids_size < NGROUPS_MAX) {
|
||||||
|
sup_gids_size *= 2;
|
||||||
|
sup_gids = tor_realloc(sup_gids, sizeof(gid_t) * sup_gids_size);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (ngids < 0) {
|
||||||
log_warn(LD_GENERAL, "Error getting supplementary GIDs: %s",
|
log_warn(LD_GENERAL, "Error getting supplementary GIDs: %s",
|
||||||
strerror(errno));
|
strerror(errno));
|
||||||
|
tor_free(sup_gids);
|
||||||
return -1;
|
return -1;
|
||||||
} else {
|
} else {
|
||||||
int i, retval = 0;
|
int i, retval = 0;
|
||||||
@ -1158,6 +1169,7 @@ log_credential_status(void)
|
|||||||
tor_free(cp);
|
tor_free(cp);
|
||||||
});
|
});
|
||||||
smartlist_free(elts);
|
smartlist_free(elts);
|
||||||
|
tor_free(sup_gids);
|
||||||
|
|
||||||
return retval;
|
return retval;
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user