setcred: Fix buffer overflow

Since groups is a pointer to a pointer to an array of gid_t, we should
use sizeof(**groups) or sizeof(gid_t) when calculating how much to
allocate and copy in.  We were using sizeof(*groups) instead, which
meant that on 64-bit platforms, we would allocate and copy in twice as
much as we should.  Unfortunately, in the smallgroups case, we copy
into a preallocated buffer which has the correct size, which means that
if sc_supp_groups_nb >= CRED_SMALLGROUPS_NB / 2, we overflow smallgroups.

This is a direct commit to stable/14.

Approved by:	so
Security:	FreeBSD-SA-26:18.setcred
Reported by:	Ryan of Calif.io
Fixes:		ddb3eb4efe55 ("New setcred() system call and associated MAC hooks")

0 files changed, 0 insertions, 0 deletions