[SSSD] [PATCH] mmap_cache: Check data->name value in client code
Lukas Slebodnik
lslebodn at redhat.com
Tue Aug 13 08:53:57 UTC 2013
On (12/08/13 19:56), Michal Židek wrote:
>This should have been part of the patch:
>[PATCH] mmap_cache: Check if slot and name_ptr are not invalid.
>
>I missed the fact that name_ptr is called just name in the
>client code and did not add check there.
>
>Using manually corrupted cache (setting name_ptr to some high value
>in hexeditor) this caused segfault in the client code. The attached
>patch fixes this.
>
>Please review and push this patch to master, 1-9 and 1-10.
>
>Thanks
>Michal
If you decided to make changes in client code you shold aslo update another
issue.
There is a pattern in functions (sss_nss_mc_getpwnam, ...)
> if (slot > MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)) {
> return ENOENT;
> }
>
> while (slot != MC_INVALID_VAL) {
This condition is subset of next condition.
> if (slot > MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)) {
> /* This probably means that the memory cache was corrupted */
> return ENOENT;
> }
> // some work
In both tests (slot != MC_INVALID_VAL) (slot > MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)
result is the same (return ENOENT).
This like a combination of blacklist and then whitelist.
Three tests from quoted example can be reduced to a one test.
LS
More information about the sssd-devel
mailing list