Hans Leidekker (@hans) commented about server/token.c:
groups_size = group_count * sizeof( attrs[0] );groups = malloc( group_count * sizeof( groups[0] ) );if (!groups){set_error( STATUS_NO_MEMORY );return;}for (i = 0; i < group_count; i++){groups[i].attrs = attrs[i];groups[i].sid = sid;groups_size += sid_len( sid );sid = (struct sid *)((char *)sid + sid_len( sid ));
This read should also be checked.