MDEV-10214: Fix segfault when using groups in PAM user mapping plugin

Mario Weigel · Mario Weigel · commit 626a62e5cce5 · 2016-06-12T23:13:26.000+12:00
diff --git a/plugin/auth_pam/mapper/pam_user_map.c b/plugin/auth_pam/mapper/pam_user_map.c
@@ -71,6 +71,7 @@ static int populate_user_groups(const char *user, gid_t **groups)
 static int user_in_group(const gid_t *user_groups, int ng,const char *group)
 {
   gid_t group_id;
+  const gid_t *groups_end = user_groups + ng;
 
   {
     struct group *g= getgrnam(group);
@@ -79,7 +80,7 @@ static int user_in_group(const gid_t *user_groups, int ng,const char *group)
     group_id= g->gr_gid;
   }
 
-  for (; user_groups < user_groups + ng; user_groups++)
+  for (; user_groups < groups_end; user_groups++)
   {
     if (*user_groups == group_id)
       return 1;
@@ -146,7 +147,7 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
       goto ret;
     }
   }
-  pam_err= PAM_SUCCESS;
+  pam_err= PAM_AUTH_ERR;
   goto ret;
 
 syntax_error:

Original file line number	Diff line number	Diff line change
`@@ -71,6 +71,7 @@ static int populate_user_groups(const char user, gid_t *groups)`
`71`	`71`	`static int user_in_group(const gid_t user_groups, int ng,const char group)`
`72`	`72`	`{`
`73`	`73`	`gid_t group_id;`
	`74`	`+ const gid_t *groups_end = user_groups + ng;`
`74`	`75`
`75`	`76`	`{`
`76`	`77`	`struct group *g= getgrnam(group);`
`@@ -79,7 +80,7 @@ static int user_in_group(const gid_t user_groups, int ng,const char group)`
`79`	`80`	`group_id= g->gr_gid;`
`80`	`81`	`}`
`81`	`82`
`82`		`- for (; user_groups < user_groups + ng; user_groups++)`
	`83`	`+ for (; user_groups < groups_end; user_groups++)`
`83`	`84`	`{`
`84`	`85`	`if (*user_groups == group_id)`
`85`	`86`	`return 1;`
`@@ -146,7 +147,7 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,`
`146`	`147`	`goto ret;`
`147`	`148`	`}`
`148`	`149`	`}`
`149`		`- pam_err= PAM_SUCCESS;`
	`150`	`+ pam_err= PAM_AUTH_ERR;`
`150`	`151`	`goto ret;`
`151`	`152`
`152`	`153`	`syntax_error:`