|
| From: | Michael Tokarev |
| Subject: | Re: [PATCH v4] linux-user: fix getgroups/setgroups allocations |
| Date: | Thu, 4 May 2023 16:46:18 +0300 |
| User-agent: | Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.10.0 |
09.04.2023 13:53, Michael Tokarev wrote:
linux-user getgroups(), setgroups(), getgroups32() and setgroups32() used alloca() to allocate grouplist arrays, with unchecked gidsetsize coming from the "guest". With NGROUPS_MAX being 65536 (linux, and it is common for an application to allocate NGROUPS_MAX for getgroups()), this means a typical allocation is half the megabyte on the stack. Which just overflows stack, which leads to immediate SIGSEGV in actual system getgroups() implementation.
Ping? Thanks, /mjt
| [Prev in Thread] | Current Thread | [Next in Thread] |