[SSSD] [PATCH] nested groups patches

Pavel Brezina pbrezina at redhat.com
Mon Jun 17 19:21:41 UTC 2013



----- Original Message -----
> From: "Stephen Gallagher" <sgallagh at redhat.com>
> To: "Development of the System Security Services Daemon" <sssd-devel at lists.fedorahosted.org>
> Sent: Monday, June 17, 2013 7:35:10 PM
> Subject: Re: [SSSD] [PATCH] nested groups patches
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 06/17/2013 11:18 AM, Pavel Brezina wrote:
> > Hi, community member John Hodrien reported two serious issues in
> > nested groups, one of which was created by my previous patch. Both
> > involves dereference.
> > 
> > 1) See commit message. This one was introduced in my previous
> > patch.
> > 
> > 2) When dereferenced member attribute contains group that is
> > present and valid in the cache, we corrupt the heap by writing
> > behind allocated memory. I believe this is the original source of
> > the bug reported in [1].
> > 
> > John confirmed that the issue is gone. Thank you.
> > 
> > [1] https://fedorahosted.org/sssd/ticket/1894
> > 
> 
> Patch 0001: Ack
> 
> Patch 0002: Nack
> If there's a bug here, it's most likely in the
> sdap_nested_group_split_members() function where we calculate the set
> of unknown members. It's already supposed to be filtering out the
> entries that already exist in the cache. I'd rather figure out why
> that function is apparently returning incorrect data.

Hi,
sdap_nested_group_split_members() works correctly. It counts only those groups that need refresh. However, dereference will always return all members, so we can't allocate the array for nested groups based on this information.

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
> 
> iEYEARECAAYFAlG/SM4ACgkQeiVVYja6o6PSxQCfb5TGx/1XqCLQmzXJg+ZF2d6R
> 38gAn1eAwH9GLZV+S5W5wCG5njvLgJ18
> =tjqO
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 



More information about the sssd-devel mailing list