----- Original Message -----
From: "Stephen Gallagher" <sgallagh(a)redhat.com>
To: "Development of the System Security Services Daemon"
<sssd-devel(a)lists.fedorahosted.org>
Sent: Monday, June 17, 2013 7:35:10 PM
Subject: Re: [SSSD] [PATCH] nested groups patches
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/17/2013 11:18 AM, Pavel Brezina wrote:
> Hi, community member John Hodrien reported two serious issues in
> nested groups, one of which was created by my previous patch. Both
> involves dereference.
>
> 1) See commit message. This one was introduced in my previous
> patch.
>
> 2) When dereferenced member attribute contains group that is
> present and valid in the cache, we corrupt the heap by writing
> behind allocated memory. I believe this is the original source of
> the bug reported in [1].
>
> John confirmed that the issue is gone. Thank you.
>
> [1]
https://fedorahosted.org/sssd/ticket/1894
>
Patch 0001: Ack
Patch 0002: Nack
If there's a bug here, it's most likely in the
sdap_nested_group_split_members() function where we calculate the set
of unknown members. It's already supposed to be filtering out the
entries that already exist in the cache. I'd rather figure out why
that function is apparently returning incorrect data.
Hi,
sdap_nested_group_split_members() works correctly. It counts only those groups that need
refresh. However, dereference will always return all members, so we can't allocate the
array for nested groups based on this information.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlG/SM4ACgkQeiVVYja6o6PSxQCfb5TGx/1XqCLQmzXJg+ZF2d6R
38gAn1eAwH9GLZV+S5W5wCG5njvLgJ18
=tjqO
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel