Bug#462175: libc6: initgroups() segfaults

[Paul Martin <pm@debian.org>]

Package: libc6
Version: 2.7-6
Severity: important

Investigating a problem with asterisk not starting, I found that 
start-stop-daemon was segfaulting when fed a group.

/etc/nsswitch.conf has not been modified.

/etc/group starts with the standard

root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
....


root@thinkpad:/tmp# LD_LIBRARY_PATH=/usr/lib/debug/ gdb --args /tmp/start-stop-daemon --start --group bin --exec /bin/sleep -- 10
GNU gdb 6.7.1-debian
Copyright (C) 2007 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
Using host libthread_db library "/usr/lib/debug/libthread_db.so.1".
(gdb) run
Starting program: /tmp/start-stop-daemon --start --group bin --exec /bin/sleep -- 10

Program received signal SIGSEGV, Segmentation fault.
*__GI_strcmp (p1=0xbfa09f17 "lp", p2=0x0) at strcmp.c:39
39      strcmp.c: No such file or directory.
        in strcmp.c
(gdb) bt full
#0  *__GI_strcmp (p1=0xbfa09f17 "lp", p2=0x0) at strcmp.c:39
        s1 = (const unsigned char *) 0xbfa09f18 "p"
        s2 = (const unsigned char *) 0x0
        c1 = 108 'l'
        c2 = 36 '$'
#1  0xb7de5b6d in _nss_compat_initgroups_dyn (user=0x0, group=2, start=0xbfa0a3c0, size=0xbfa0a3e8, groupsp=0xbfa0a3e4, limit=65536, errnop=0xb7de989c)
    at nss_compat/compat-initgroups.c:216
        buflen = 1024
        tmpbuf = 0xbfa09f10 "lp"
        status = <value optimized out>
        intern = {files = 1, stream = 0x804f9a8, blacklist = {data = 0x0, current = 0, size = 0}}
#2  0xb7e7cad6 in internal_getgrouplist (user=0x0, group=2, size=0xbfa0a3e8, groupsp=0xbfa0a3e4, limit=65536) at initgroups.c:105
        prev_start = 1
        cnt = <value optimized out>
        nip = (service_user *) 0x804e668
        fct = (initgroups_dyn_function) 0xb7de5940 <_nss_compat_initgroups_dyn>
        status = -1209697043
        no_more = <value optimized out>
        start = 1
        __PRETTY_FUNCTION__ = "internal_getgrouplist"
#3  0xb7e7ccbd in initgroups (user=0x0, group=2) at initgroups.c:206
        size = 64
        groups = (gid_t *) 0x804f7c0
        ngroups = <value optimized out>
        result = -1
        limit = 65536
#4  0x0804ab75 in main (argc=8, argv=0xbfa0a520) at ../../utils/start-stop-daemon.c:1423
        i = <value optimized out>
        devnull_fd = -1
        tty_fd = -1


-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (99, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.23-hrt1 (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages libc6 depends on:
ii  libgcc1                 1:4.3-20080116-1 GCC support library

libc6 recommends no packages.

-- debconf information excluded