group.gr_mem is a vector of pointers; use address of buffer instead

of buffer. This could have caused reading of garbage memory if the NSS
implementation does not zero out the buffer passed to NSS modules.

diff --git a/nss_afs.c b/nss_afs.c
index 126b5c5..fef20d9 100644 (file)
--- a/nss_afs.c
+++ b/nss_afs.c
@@ -390,7 +390,7 @@ enum nss_status _nss_afs_getgrgid_r (gid_t gid,
     if (!cpstr("z",&buffer,&buflen)) break;
 
     if (buflen < sizeof(char*)) break;
-    result->gr_mem=buffer;
+    result->gr_mem=&buffer;
     result->gr_mem[0] = NULL;
 
     *errnop=errno;