[SSSD] [PATCH] mmap_cache: Check data->name value in client code

Simo Sorce simo at redhat.com
Mon Aug 12 21:07:42 UTC 2013


On Mon, 2013-08-12 at 19:56 +0200, Michal Židek wrote:
> This should have been part of the patch:
> [PATCH] mmap_cache: Check if slot and name_ptr are not invalid.
> 
> I missed the fact that name_ptr is called just name in the
> client code and did not add check there.
> 
> Using manually corrupted cache (setting name_ptr to some high value
> in hexeditor) this caused segfault in the client code. The attached
> patch fixes this.
> 
> Please review and push this patch to master, 1-9 and 1-10.

I do not think this patch is correct.
Although normally data->name will point to data->strs it is a separate
pointer exactly becsaue the server code may decide to put the name
string somewhere in the strs buffer but not necessarily at the start.

What you need to check is somehing like:
if (data->name > offsetof(struct sss_mc_pwd_data, strs) +
data->strs_len) { return ENOENT; }

... except you should probably not trust strs_len entirely at this point
if you are trying to catch malformed data and you should also check that
data + strs_len is within the mmaped memory region.

Also at this point it may make sense to do a strlen(name) upfront and
check that strs_len > name and return immediately if not.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list