[SSSD] [PATCH] LDAP: Fix crash when processing nested groups

Pavel Březina pbrezina at redhat.com
Wed Aug 7 07:53:13 UTC 2013


On 08/06/2013 09:25 PM, Jakub Hrozek wrote:
> https://fedorahosted.org/sssd/ticket/1932
>
> There is a rather strange workaround in the nested groups processing
> code that calls tevent_req_post outside _send(). However, it broke in
> certain situations where the tevent_req_call resulted in req being freed,
> which freed state by extension and then the subsequent _post call was a
> use-after-free. This patch saves the two variables used outside state so
> that it's safe to use them even after the callback.

Hi,
great catch! Sometimes I wish tevent_req_done() would schedule immediate 
event, instead of firing the callback directly.

Nack to the patch but ack to the solution. The same code is also in 
sdap_nested_group_lookup_user(). Can you fix it as well? It maybe can't 
be triggered, but who knows...



More information about the sssd-devel mailing list