[SSSD] [PATCH] mmap_cache: Check data->name value in client code

Lukas Slebodnik lslebodn at redhat.com
Tue Aug 13 08:53:57 UTC 2013


On (12/08/13 19:56), Michal Židek wrote:
>This should have been part of the patch:
>[PATCH] mmap_cache: Check if slot and name_ptr are not invalid.
>
>I missed the fact that name_ptr is called just name in the
>client code and did not add check there.
>
>Using manually corrupted cache (setting name_ptr to some high value
>in hexeditor) this caused segfault in the client code. The attached
>patch fixes this.
>
>Please review and push this patch to master, 1-9 and 1-10.
>
>Thanks
>Michal

If you decided to make changes in client code you shold aslo update another
issue.

There is a pattern in functions (sss_nss_mc_getpwnam, ...)
>    if (slot > MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)) {
>        return ENOENT;
>    }
>
>    while (slot != MC_INVALID_VAL) {
     This condition is subset of next condition.
>        if (slot > MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)) {
>            /* This probably means that the memory cache was corrupted */
>            return ENOENT;
>        }
>        // some work

In both tests (slot != MC_INVALID_VAL) (slot > MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)
result is the same (return ENOENT).
This like a combination of blacklist and then whitelist.

Three tests from quoted example can be reduced to a one test.

LS



More information about the sssd-devel mailing list