Re: getgrouplist segfault?

[Leonard den Ottolander <leonard den ottolander nl>]

Hello Roland,

On Wed, 2005-07-06 at 20:15, Roland Illig wrote:
> Pavel Tsekov wrote:
> > BUGS
> >        The glibc 2.3.2 implementation of this function is broken: it
> >        overwrites memory when the actual number of groups  is  larger
> >        than *ngroups.
> 
> As this is clearly a buffer overflow, we should not use the function at 
> all and document this somewhere. Maybe like that:
> 
> #if 0
> /* the glibc implementation of getgrouplist(3) has a
>   * buffer overflow vulnerability, so we cannot use this function */
> ...
> #endif

What a curious suggestion. If we wouldn't use functions that might have
been poorly implemented in any version of any library mc uses there
wouldn't be many functions left to use after a while. If this is indeed
a glibc issue the user should patch his glibc.

Leonard.

-- 
mount -t life -o ro /dev/dna /genetic/research