[PATCH] Fix potential use after free in uidswap.c (portable)

["Albert S." <mail@xxxxxxxxxxxxxxx>]

Fixes a potential (but probably rather unlikely) use after free bug in
function temporarily_use_uid(), file uidswap.c.

--- a/uidswap.c
+++ b/uidswap.c
@@ -113,8 +113,9 @@ temporarily_use_uid(struct passwd *pw)
                }
        }
        /* Set the effective uid to the given (unprivileged) uid. */
-       if (setgroups(user_groupslen, user_groups) < 0)
-               fatal("setgroups: %.100s", strerror(errno));
+       if (user_groupslen > 0 &&
+            (setgroups(user_groupslen, user_groups)) < 0)
+               fatal("setgroups: %.100s", strerror(errno));

Best regards,
Albert
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev