When a user is in more than 16 groups the call to authunix_create() will

result in abort() beeing called. This is because there is a limit of
the number of groups in the RPC which is 16. When the actual number of
groups is too large it results in xdr_array() returning an error which,
in turn, authunix_create() handles by just calling abort().

Fix this by passing only the first 16 groups to authunix_create().

1 files changed, 6 insertions, 1 deletions

diff --git a/usr.sbin/rpc.lockd/kern.c b/usr.sbin/rpc.lockd/kern.c
index ef5d268..c7473f6 100644
--- a/usr.sbin/rpc.lockd/kern.c
+++ b/usr.sbin/rpc.lockd/kern.c
@@ -231,12 +231,17 @@ set_auth(cl, xucred)
 	CLIENT *cl;
 	struct xucred *xucred;
 {
+	int ngroups;
+
+	ngroups = xucred->cr_ngroups - 1;
+	if (ngroups > NGRPS)
+		ngroups = NGRPS;
         if (cl->cl_auth != NULL)
                 cl->cl_auth->ah_ops->ah_destroy(cl->cl_auth);
         cl->cl_auth = authunix_create(hostname,
                         xucred->cr_uid,
                         xucred->cr_groups[0],
-                        xucred->cr_ngroups - 1,
+                        ngroups,
                         &xucred->cr_groups[1]);
 }