-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/17/2013 03:21 PM, Pavel Brezina wrote:
----- Original Message -----
> From: "Stephen Gallagher" <sgallagh(a)redhat.com> To:
"Development
> of the System Security Services Daemon"
> <sssd-devel(a)lists.fedorahosted.org> Sent: Monday, June 17, 2013
> 7:35:10 PM Subject: Re: [SSSD] [PATCH] nested groups patches
>
On 06/17/2013 11:18 AM, Pavel Brezina wrote:
>>> Hi, community member John Hodrien reported two serious issues
>>> in nested groups, one of which was created by my previous
>>> patch. Both involves dereference.
>>>
>>> 1) See commit message. This one was introduced in my
>>> previous patch.
>>>
>>> 2) When dereferenced member attribute contains group that is
>>> present and valid in the cache, we corrupt the heap by
>>> writing behind allocated memory. I believe this is the
>>> original source of the bug reported in [1].
>>>
>>> John confirmed that the issue is gone. Thank you.
>>>
>>> [1]
https://fedorahosted.org/sssd/ticket/1894
>>>
Patch 0001: Ack
Patch 0002: Nack If there's a bug here, it's most likely in the
sdap_nested_group_split_members() function where we calculate the
set of unknown members. It's already supposed to be filtering out
the entries that already exist in the cache. I'd rather figure out
why that function is apparently returning incorrect data.
> Hi, sdap_nested_group_split_members() works correctly. It counts
> only those groups that need refresh. However, dereference will
> always return all members, so we can't allocate the array for
> nested groups based on this information.
Ahh, that makes sense then. Ack.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlG/YrQACgkQeiVVYja6o6NHgQCeMM35UHjQbnAlezdH9BJDn8/k
cLkAnRnVnFqz7841u9Rumrtde/iy2o3X
=qGE2
-----END PGP SIGNATURE-----