[SSSD] [PATCH] Fix memory context for hash entries

Sumit Bose sbose at redhat.com
Wed Aug 7 12:00:27 UTC 2013


Hi,

here is another fix for a use-after-free of variables allocated on a
temporary memory context.

bye,
Sumit
-------------- next part --------------
From 5b627108452d66aeeda1f8ee614de8ed44f1314f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 7 Aug 2013 13:01:09 +0200
Subject: [PATCH] Fix memory context for hash entries

In sdap_nested_group_populate_users() username and orignal_dn are
allocated on a temporary memory context. If the corresponding user is
not found in the cache both are added to a hash which is later on
returned to the caller. To avoid a use-after-free when the hash entries
are looked up both must be reassigned to the memory context of the hash.
---
 src/providers/ldap/sdap_async_groups.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c
index 9f66732..a2e5106 100644
--- a/src/providers/ldap/sdap_async_groups.c
+++ b/src/providers/ldap/sdap_async_groups.c
@@ -2107,11 +2107,13 @@ static errno_t sdap_nested_group_populate_users(TALLOC_CTX *mem_ctx,
             if (ret != EOK) goto done;
         } else {
             key.type = HASH_KEY_STRING;
-            key.str = discard_const(original_dn);
+            key.str = talloc_steal(ghosts, discard_const(original_dn));
             value.type = HASH_VALUE_PTR;
-            value.ptr = discard_const(username);
+            value.ptr = talloc_steal(ghosts, discard_const(username));
             ret = hash_enter(ghosts, &key, &value);
             if (ret != HASH_SUCCESS) {
+                talloc_free(key.str);
+                talloc_free(value.ptr);
                 ret = ENOMEM;
                 goto done;
             }
-- 
1.7.7.6



More information about the sssd-devel mailing list