[SSSD] [PATCH] Prevent segfault if vetoed_shells are specified without allowed_shells

Jakub Hrozek jhrozek at redhat.com
Mon Aug 8 12:43:57 UTC 2011


On Mon, Aug 08, 2011 at 06:02:45AM -0400, Alexander Bokovoy wrote:
> Hi,
> 
> seems OK but could you also add similar treatment for etc_shells? There are few rare cases when out of memory situations could make nctx->etc_shells NULL.
> 

We handle OOM when loading the etc_shells array but more checks never
hurt, I guess.
-------------- next part --------------
>From 79efdd2cb91b72cfa222674aa1b2168fae449d30 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 8 Aug 2011 10:57:16 +0200
Subject: [PATCH] Prevent segfault if vetoed_shells are specified without
 allowed_shells

https://fedorahosted.org/sssd/ticket/954
---
 src/responder/nss/nsssrv_cmd.c |   35 +++++++++++++++++++----------------
 1 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 5dbd3ca..56ebe48 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -316,8 +316,7 @@ static const char *get_shell_override(TALLOC_CTX *mem_ctx,
     if (!user_shell) return NULL;
     if (!nctx->allowed_shells && !nctx->vetoed_shells) return talloc_strdup(mem_ctx, user_shell);
 
-    if (nctx->vetoed_shells)
-    {
+    if (nctx->vetoed_shells) {
         for (i=0; nctx->vetoed_shells[i]; i++) {
             if (strcmp(nctx->vetoed_shells[i], user_shell) == 0) {
                 DEBUG(5, ("The shell '%s' is vetoed. "
@@ -327,24 +326,28 @@ static const char *get_shell_override(TALLOC_CTX *mem_ctx,
         }
     }
 
-    for (i=0; nctx->etc_shells[i]; i++) {
-        if (strcmp(user_shell, nctx->etc_shells[i]) == 0) {
-            DEBUG(9, ("Shell %s found in /etc/shells\n",
-                      nctx->etc_shells[i]));
-            break;
+    if (nctx->etc_shells) {
+        for (i=0; nctx->etc_shells[i]; i++) {
+            if (strcmp(user_shell, nctx->etc_shells[i]) == 0) {
+                DEBUG(9, ("Shell %s found in /etc/shells\n",
+                        nctx->etc_shells[i]));
+                break;
+            }
         }
-    }
 
-    if (nctx->etc_shells[i]) {
-        DEBUG(9, ("Using original shell '%s'\n", user_shell));
-        return talloc_strdup(mem_ctx, user_shell);
+        if (nctx->etc_shells[i]) {
+            DEBUG(9, ("Using original shell '%s'\n", user_shell));
+            return talloc_strdup(mem_ctx, user_shell);
+        }
     }
 
-    for (i=0; nctx->allowed_shells[i]; i++) {
-        if (strcmp(nctx->allowed_shells[i], user_shell) == 0) {
-            DEBUG(5, ("The shell '%s' is allowed but does not exist. "
-                      "Using fallback\n", user_shell));
-            return talloc_strdup(mem_ctx, nctx->shell_fallback);
+    if (nctx->allowed_shells) {
+        for (i=0; nctx->allowed_shells[i]; i++) {
+            if (strcmp(nctx->allowed_shells[i], user_shell) == 0) {
+                DEBUG(5, ("The shell '%s' is allowed but does not exist. "
+                        "Using fallback\n", user_shell));
+                return talloc_strdup(mem_ctx, nctx->shell_fallback);
+            }
         }
     }
 
-- 
1.7.6



More information about the sssd-devel mailing list