bpo-35070: test_getgrouplist may fail on macOS if too many groups (GH-13071)

(cherry picked from commit 8725c83) Co-authored-by: Jeffrey Kintscher <49998481+websurfer5@users.noreply.github.com>

Author: miss-islington

Misc/NEWS.d/next/Library/2019-05-09-18-50-55.bpo-35070.4vaqNL.rst

@@ -0,0 +1,2 @@
+posix.getgrouplist() now works correctly when the user belongs to
+NGROUPS_MAX supplemental groups. Patch by Jeffrey Kintscher.

Modules/posixmodule.c

@@ -6722,6 +6722,13 @@ os_getpid_impl(PyObject *module)
 }
 #endif /* HAVE_GETPID */
 
+#ifdef NGROUPS_MAX
+#define MAX_GROUPS NGROUPS_MAX
+#else
+ /* defined to be 16 on Solaris7, so this should be a small number */
+#define MAX_GROUPS 64
+#endif
+
 #ifdef HAVE_GETGROUPLIST
 
 /* AC 3.5: funny apple logic below */
@@ -6734,13 +6741,6 @@ Returns a list of groups to which a user belongs.\n\n\
 static PyObject *
 posix_getgrouplist(PyObject *self, PyObject *args)
 {
-#ifdef NGROUPS_MAX
-#define MAX_GROUPS NGROUPS_MAX
-#else
- /* defined to be 16 on Solaris7, so this should be a small number */
-#define MAX_GROUPS 64
-#endif
-
  const char *user;
  int i, ngroups;
  PyObject *list;
@@ -6749,7 +6749,16 @@ posix_getgrouplist(PyObject *self, PyObject *args)
 #else
  gid_t *groups, basegid;
 #endif
- ngroups = MAX_GROUPS;
+
+ /*
+ * NGROUPS_MAX is defined by POSIX.1 as the maximum
+ * number of supplimental groups a users can belong to.
+ * We have to increment it by one because
+ * getgrouplist() returns both the supplemental groups
+ * and the primary group, i.e. all of the groups the
+ * user belongs to.
+ */
+ ngroups = 1 + MAX_GROUPS;
 
 #ifdef __APPLE__
  if (!PyArg_ParseTuple(args, "si:getgrouplist", &user, &basegid))
@@ -6818,13 +6827,6 @@ os_getgroups_impl(PyObject *module)
 /*[clinic end generated code: output=42b0c17758561b56 input=d3f109412e6a155c]*/
 {
  PyObject *result = NULL;
-
-#ifdef NGROUPS_MAX
-#define MAX_GROUPS NGROUPS_MAX
-#else
- /* defined to be 16 on Solaris7, so this should be a small number */
-#define MAX_GROUPS 64
-#endif
  gid_t grouplist[MAX_GROUPS];
 
  /* On MacOSX getgroups(2) can return more than MAX_GROUPS results