[SSSD] [PATCH] nested groups patches

Stephen Gallagher sgallagh at redhat.com
Mon Jun 17 19:25:40 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/17/2013 03:21 PM, Pavel Brezina wrote:
> 
> 
> ----- Original Message -----
>> From: "Stephen Gallagher" <sgallagh at redhat.com> To: "Development
>> of the System Security Services Daemon"
>> <sssd-devel at lists.fedorahosted.org> Sent: Monday, June 17, 2013
>> 7:35:10 PM Subject: Re: [SSSD] [PATCH] nested groups patches
>> 
> On 06/17/2013 11:18 AM, Pavel Brezina wrote:
>>>> Hi, community member John Hodrien reported two serious issues
>>>> in nested groups, one of which was created by my previous
>>>> patch. Both involves dereference.
>>>> 
>>>> 1) See commit message. This one was introduced in my
>>>> previous patch.
>>>> 
>>>> 2) When dereferenced member attribute contains group that is 
>>>> present and valid in the cache, we corrupt the heap by
>>>> writing behind allocated memory. I believe this is the
>>>> original source of the bug reported in [1].
>>>> 
>>>> John confirmed that the issue is gone. Thank you.
>>>> 
>>>> [1] https://fedorahosted.org/sssd/ticket/1894
>>>> 
> 
> Patch 0001: Ack
> 
> Patch 0002: Nack If there's a bug here, it's most likely in the 
> sdap_nested_group_split_members() function where we calculate the
> set of unknown members. It's already supposed to be filtering out
> the entries that already exist in the cache. I'd rather figure out
> why that function is apparently returning incorrect data.
> 
>> Hi, sdap_nested_group_split_members() works correctly. It counts
>> only those groups that need refresh. However, dereference will
>> always return all members, so we can't allocate the array for
>> nested groups based on this information.
> 

Ahh, that makes sense then. Ack.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlG/YrQACgkQeiVVYja6o6NHgQCeMM35UHjQbnAlezdH9BJDn8/k
cLkAnRnVnFqz7841u9Rumrtde/iy2o3X
=qGE2
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list