mgetgroups: do not write bytes beyond end of malloc'd buffer

[pspp] / lib / mgetgroups.c

diff --git a/lib/mgetgroups.c b/lib/mgetgroups.c
index 89d161846a6288398e5a022047300a3f05d2ae25..0f853d6f8b2c1a56aab1cd6140e5c79402f568ad 100644 (file)
--- a/lib/mgetgroups.c
+++ b/lib/mgetgroups.c
@@ -141,7 +141,8 @@ mgetgroups (char const *username, gid_t gid, gid_t **groups)
 
   ng = (username
         ? getugroups (max_n_groups, g, username, gid)
-        : getgroups (max_n_groups, g + (gid != (gid_t) -1)));
+        : getgroups (max_n_groups - (gid != (gid_t) -1),
+                                g + (gid != (gid_t) -1)));
 
   if (ng < 0)
     {