From 3f19b0a34ee51ff0e0bfe930d6e8b2cbc2d96893 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Mon, 16 Mar 2009 13:17:04 +0100
Subject: [PATCH] Fix #6130: Don't crash in winbindd_rpc lookup_groupmem() on
 unmapped members
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Thanks to François Legal <devel@thom.fr.eu.org> for reporting this bug
(cherry picked from commit e6a23d498bfd4bbe19cecf24ba3f94af83c9bf8b)
---
 source/winbindd/winbindd_rpc.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/source/winbindd/winbindd_rpc.c b/source/winbindd/winbindd_rpc.c
index b03e035900e..f6a9c666bcf 100644
--- a/source/winbindd/winbindd_rpc.c
+++ b/source/winbindd/winbindd_rpc.c
@@ -821,14 +821,15 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 		}
 
 		for (r=0; r<tmp_names.count; r++) {
-			(*names)[i+r] = fill_domain_username_talloc(mem_ctx,
-						domain->name,
-						tmp_names.names[r].string,
-						true);
-			(*name_types)[i+r] = tmp_types.ids[r];
+			if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
+				continue;
+			}
+			(*names)[total_names] = fill_domain_username_talloc(
+				mem_ctx, domain->name,
+				tmp_names.names[r].string, true);
+			(*name_types)[total_names] = tmp_types.ids[r];
+			total_names += 1;
 		}
-
-		total_names += tmp_names.count;
         }
 
         *num_names = total_names;
-- 
2.11.4.GIT