[SSSD] [PATCH] Do not try to set password when authtok_length is zero

Ondrej Kos okos at redhat.com
Mon Jun 24 15:04:57 UTC 2013


The problem here wasn't in returned error code, but in faultly read DBUS 
message, due to condition in sss_authtok_set_string.

When password is empty, it passes 0 as length, which is misinterpreted, 
and the function tries to determine the length of string by itself, 
reaching over boundaries of authtok string.

trac issue: https://fedorahosted.org/sssd/ticket/1814

Patch is attached

Ondra
-- 
Ondrej Kos
Associate Software Engineer
Identity Management - SSSD
Red Hat Czech
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Do-not-try-to-set-password-when-authtok_length-is-ze.patch
Type: text/x-patch
Size: 1458 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130624/60c1838d/attachment.bin>


More information about the sssd-devel mailing list