[SSSD] [PATCH] Fix memory context for hash entries
Sumit Bose
sbose at redhat.com
Wed Aug 7 12:00:27 UTC 2013
Hi,
here is another fix for a use-after-free of variables allocated on a
temporary memory context.
bye,
Sumit
-------------- next part --------------
From 5b627108452d66aeeda1f8ee614de8ed44f1314f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 7 Aug 2013 13:01:09 +0200
Subject: [PATCH] Fix memory context for hash entries
In sdap_nested_group_populate_users() username and orignal_dn are
allocated on a temporary memory context. If the corresponding user is
not found in the cache both are added to a hash which is later on
returned to the caller. To avoid a use-after-free when the hash entries
are looked up both must be reassigned to the memory context of the hash.
---
src/providers/ldap/sdap_async_groups.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c
index 9f66732..a2e5106 100644
--- a/src/providers/ldap/sdap_async_groups.c
+++ b/src/providers/ldap/sdap_async_groups.c
@@ -2107,11 +2107,13 @@ static errno_t sdap_nested_group_populate_users(TALLOC_CTX *mem_ctx,
if (ret != EOK) goto done;
} else {
key.type = HASH_KEY_STRING;
- key.str = discard_const(original_dn);
+ key.str = talloc_steal(ghosts, discard_const(original_dn));
value.type = HASH_VALUE_PTR;
- value.ptr = discard_const(username);
+ value.ptr = talloc_steal(ghosts, discard_const(username));
ret = hash_enter(ghosts, &key, &value);
if (ret != HASH_SUCCESS) {
+ talloc_free(key.str);
+ talloc_free(value.ptr);
ret = ENOMEM;
goto done;
}
--
1.7.7.6
More information about the sssd-devel
mailing list