[SSSD] [PATCH] Fix memory context for a state member

Pavel Březina pbrezina at redhat.com
Wed Aug 7 09:06:46 UTC 2013


On 08/07/2013 10:51 AM, Sumit Bose wrote:
> Hi,
>
> I came across this while testing other stuff. I think the issue was
> introduced in 1.10, 1.9 looks fine.
>
> bye,
> Sumit
>
>
> 0001-Fix-memory-context-for-a-state-member.patch
>
>
>  From b49edd8a0c16365f5243b8d2f076e54baeee4a27 Mon Sep 17 00:00:00 2001
> From: Sumit Bose<sbose at redhat.com>
> Date: Wed, 7 Aug 2013 10:34:52 +0200
> Subject: [PATCH] Fix memory context for a state member
>
> primary_name was allocated on a temporary memory context but as it is a
> member of the state struct it should belong to the memory context of the
> state.
> ---
>   src/providers/ldap/sdap_async_initgroups.c |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
> index ec1cf3e..5242c1a 100644
> --- a/src/providers/ldap/sdap_async_initgroups.c
> +++ b/src/providers/ldap/sdap_async_initgroups.c
> @@ -2185,7 +2185,7 @@ static errno_t rfc2307bis_nested_groups_step(struct tevent_req *req)
>           goto done;
>       }
>
> -    ret = sdap_get_group_primary_name(tmp_ctx, state->opts,
> +    ret = sdap_get_group_primary_name(state, state->opts,
>                                         state->groups[state->group_iter],
>                                         state->dom, &state->primary_name);
>       if (ret != EOK) {
> -- 1.7.7.6

Ack.

I think it is a little bit serious than the commit message implies :-) 
state->primary_name is referenced later in 
rfc2307bis_nested_groups_process() which is a callback for ldap search. 
Since tmp_ctx is freed we end up with use-after-free.




More information about the sssd-devel mailing list