[SSSD] [PATCH] Fix memory context for a state member
Pavel Březina
pbrezina at redhat.com
Wed Aug 7 09:06:46 UTC 2013
On 08/07/2013 10:51 AM, Sumit Bose wrote:
> Hi,
>
> I came across this while testing other stuff. I think the issue was
> introduced in 1.10, 1.9 looks fine.
>
> bye,
> Sumit
>
>
> 0001-Fix-memory-context-for-a-state-member.patch
>
>
> From b49edd8a0c16365f5243b8d2f076e54baeee4a27 Mon Sep 17 00:00:00 2001
> From: Sumit Bose<sbose at redhat.com>
> Date: Wed, 7 Aug 2013 10:34:52 +0200
> Subject: [PATCH] Fix memory context for a state member
>
> primary_name was allocated on a temporary memory context but as it is a
> member of the state struct it should belong to the memory context of the
> state.
> ---
> src/providers/ldap/sdap_async_initgroups.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
> index ec1cf3e..5242c1a 100644
> --- a/src/providers/ldap/sdap_async_initgroups.c
> +++ b/src/providers/ldap/sdap_async_initgroups.c
> @@ -2185,7 +2185,7 @@ static errno_t rfc2307bis_nested_groups_step(struct tevent_req *req)
> goto done;
> }
>
> - ret = sdap_get_group_primary_name(tmp_ctx, state->opts,
> + ret = sdap_get_group_primary_name(state, state->opts,
> state->groups[state->group_iter],
> state->dom, &state->primary_name);
> if (ret != EOK) {
> -- 1.7.7.6
Ack.
I think it is a little bit serious than the commit message implies :-)
state->primary_name is referenced later in
rfc2307bis_nested_groups_process() which is a callback for ldap search.
Since tmp_ctx is freed we end up with use-after-free.
More information about the sssd-devel
mailing list