user: prevent falling back to looking up numeric usernames

[thaJeztah]

• relates to oci: return explicit error for out-of-range USER values containerd/containerd#13446
• relates to containerd/containerd@de1341c

Addresses a similar issue as CVE-2026-46680 in containerd.

[vvoland]

This only tests the case where gid/uid still falls within int .

If it's larger, it will still resolve to root because it will be treated as an username and still resolved.

So:

9223372036854775808:x:0:0:root:/root:/bin/sh

• USER 9223372036854775808

Means that the runtime will actually resolve it to root.

This is "correct" behavior, but its confusing to treat a numeric value as an username.

[thaJeztah]

@vvoland - trying to see where that codepath would be; testing GetExecUser with 2147483648 (math.MaxInt32 + 1) produces an error; or is it a different codepath you're looking at?

[vvoland]

On 64 bit strconv.Atoi will handle MaxInt32 + 1 without an error

[vvoland]

Do we need the same for GetAdditionalGroups?

[thaJeztah]

Yeah, makes sense; also updated

As a follow-up, I'm considering cleaning up this code; the logic seems to be much too complicated.

[vvoland]

Should this be

Suggested change

	return g.Gid == ag.gid
	if g.Gid == ag.gid {
	return true
	}

?

[thaJeztah]

No, don't think so, because then it would continue to check if g.Name == ag.name {, and we know it's a numeric value, so we can return the results (did it match, or not?)

[thaJeztah]

Doh! You're right though; because we still want to continue the loop here 🙈

[thaJeztah]

Updated, and added a test-case;

diff --git a/user/user.go b/user/user.go
index 8012094..f47e250 100644
--- a/user/user.go
+++ b/user/user.go
@@ -480,8 +480,8 @@ func GetAdditionalGroups(additionalGroups []string, group io.Reader) ([]int, err
 		var err error
 		groups, err = ParseGroupFilter(group, func(g Group) bool {
 			for _, ag := range addtlGroups {
-				if ag.isNumeric {
-					return g.Gid == ag.gid
+				if ag.isNumeric && g.Gid == ag.gid {
+					return true
 				}
 				if g.Name == ag.name {
 					return true
diff --git a/user/user_test.go b/user/user_test.go
index 1e16861..6837e53 100644
--- a/user/user_test.go
+++ b/user/user_test.go
@@ -477,6 +477,11 @@ this is just some garbage data
 			groups:   []string{"adm"},
 			expected: []int{43},
 		},
+		{
+			// numeric group miss must continue checking remaining groups
+			groups:   []string{"10001", "adm"},
+			expected: []int{43, 10001},
+		},
 		{
 			// multiple groups
 			groups:   []string{"adm", "grp"},

[kolyshkin]

I wonder why we don't use something like containerd/containerd@85706b6 (i.e. use strconv.Atoi or strconv.ParseUint) and check its errors, as well as the range. Basically, here we parse the string twice, duplicating the strconv functionality.

[thaJeztah]

Ah, you're right; I was trying to detect early because the logic is slightly different here, but we can use the error returned here to detect whether it was a range error, or a syntax error (non-numeric).

Let me update