summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRich Felker <dalias@aerifal.cx>2011-06-30 08:11:06 -0400
committerRich Felker <dalias@aerifal.cx>2011-06-30 08:11:06 -0400
commitfb62ae74d0c87ff506e970bf18579cc96b16e046 (patch)
tree728685c7e1b6871293c11c4cd2a8cc29364a2d4f
parentf9ed11f3e1337d6bac6298db1d66d4f27bb59f6b (diff)
downloadmusl-fb62ae74d0c87ff506e970bf18579cc96b16e046.tar.gz
musl-fb62ae74d0c87ff506e970bf18579cc96b16e046.tar.bz2
musl-fb62ae74d0c87ff506e970bf18579cc96b16e046.tar.xz
musl-fb62ae74d0c87ff506e970bf18579cc96b16e046.zip
fix buffer overrun in getgrent code when there are no group members
-rw-r--r--src/passwd/getgrent_a.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/src/passwd/getgrent_a.c b/src/passwd/getgrent_a.c
index ccb51d52..7c63c57b 100644
--- a/src/passwd/getgrent_a.c
+++ b/src/passwd/getgrent_a.c
@@ -37,10 +37,14 @@ struct group *__getgrent_a(FILE *f, struct group *gr, char **line, size_t *size,
*line = 0;
return 0;
}
- mem[0][0] = mems;
- for (s=mems, i=0; *s; s++)
- if (*s==',') *s++ = 0, mem[0][++i] = s;
- mem[0][++i] = 0;
+ if (*mems) {
+ mem[0][0] = mems;
+ for (s=mems, i=0; *s; s++)
+ if (*s==',') *s++ = 0, mem[0][++i] = s;
+ mem[0][++i] = 0;
+ } else {
+ mem[0][0] = 0;
+ }
gr->gr_mem = *mem;
return gr;
}