Re: [PATCH] Add NULL checks for getugroups grouplist argument

Rx wrote:
> For example, if the user doesn't have an allocated buffer yet but has 
> strict memory constraints, they may need to know how many groups there 
> are before allocating the buffer. They could pass NULL as grouplist and 
> maxcount as an upper bound for the buffer size. Then, when the function 
> returns the count, it would provide a size that is guaranteed to fit 
> within the user's memory constraints.

This is the style that many Windows APIs use. I hate this style, because
  * As a programmer, I have to write 2 calls to a certain function.
  * The kernel has to collect the information twice.
  * The size is still *not* guaranteed to fit, because there is a race
    condition: The sysadmin might add the user into another group,
    just between the two calls.

I much prefer the approach with a stack-allocated buffer of small size.
See e.g.
  gnulib/lib/xgetaname-impl.h
  gnulib/lib/string-buffer.h
It uses
  * multiple calls to the function only rarely,
  * thus is efficient (on average),
  * and does not have race conditions.

Bruno