user: Fix GetAdditionalGroups panic on empty group name

user/user.go

@@ -303,13 +303,21 @@ func GetExecUser(userSpec string, defaults *ExecUser, passwd, group io.Reader) (
 
 	// Convert usr and grp to be numeric, so we don't have to execute
 	// Atoi *twice* for each iteration over lines.
-	userArg, err := parseUserArg(usr)
-	if err != nil {
-		return nil, err
+	var userArg *userArg
+	if usr != "" {
+		var err error
+		userArg, err = parseUserArg(usr)
+		if err != nil {
+			return nil, err
+		}
 	}
-	groupArg, err := parseGroupArg(grp)
-	if err != nil {
-		return nil, err
+	var groupArg *groupArg
+	if grp != "" {
+		var err error
+		groupArg, err = parseGroupArg(grp)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	// Find the matching user.

user/user_test.go

@@ -590,6 +590,12 @@ this is just some garbage data
 			expected: nil,
 			hasError: true,
 		},
+		{
+			doc:      "empty group name",
+			groups:   []string{"adm", ""},
+			expected: nil,
+			hasError: true,
+		},
 		{
 			doc:      "group with numeric id",
 			groups:   []string{"43"},

user/user_utils.go

@@ -71,12 +71,9 @@ type userArg struct {
 }
 
 // parseUserArg parses a user argument as either a user name or UID.
-//
-// If name is empty, parseUserArg returns "nil, nil" to indicate that no user
-// argument was specified.
 func parseUserArg(name string) (*userArg, error) {
 	if name == "" {
-		return nil, nil
+		return nil, errors.New("empty user")
 	}
 	uid, isNumeric, err := parseNumeric(name)
 	if err != nil {
@@ -102,12 +99,9 @@ type groupArg struct {
 }
 
 // parseGroupArg parses a group argument as either a group name or GID.
-//
-// If name is empty, parseGroupArg returns "nil, nil" to indicate that no group
-// argument was specified.
 func parseGroupArg(name string) (*groupArg, error) {
 	if name == "" {
-		return nil, nil
+		return nil, errors.New("empty group")
 	}
 	gid, isNumeric, err := parseNumeric(name)
 	if err != nil {