|
 |
403b09 |
From 98bdf4755d5c0256d26ba6a6aed6b9e649adf941 Mon Sep 17 00:00:00 2001
|
|
|
403b09 |
From: Thierry Bordaz <tbordaz@redhat.com>
|
|
|
403b09 |
Date: Mon, 18 Jul 2016 15:00:02 +0200
|
|
|
403b09 |
Subject: [PATCH] Heap corruption in ipapwd plugin
|
|
|
403b09 |
|
|
|
403b09 |
ipapwd_encrypt_encode_key allocates 'kset' on the heap but
|
|
|
403b09 |
with num_keys and keys not being initialized.
|
|
|
403b09 |
Then ipa_krb5_generate_key_data initializes them with the
|
|
|
403b09 |
generated keys.
|
|
|
403b09 |
If ipa_krb5_generate_key_data fails (here EINVAL meaning no
|
|
|
403b09 |
principal->realm.data), num_keys and keys are left uninitialized.
|
|
|
403b09 |
Upon failure, ipapwd_keyset_free is called to free 'kset'
|
|
|
403b09 |
that contains random num_keys and keys.
|
|
|
403b09 |
|
|
|
403b09 |
allocates kset with calloc so that kset->num_keys==0 and
|
|
|
403b09 |
kset->keys==NULL
|
|
|
403b09 |
|
|
|
403b09 |
https://fedorahosted.org/freeipa/ticket/6030
|
|
|
403b09 |
|
|
|
403b09 |
Reviewed-By: Simo Sorce <ssorce@redhat.com>
|
|
|
403b09 |
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
|
|
|
403b09 |
---
|
|
|
403b09 |
daemons/ipa-slapi-plugins/ipa-pwd-extop/encoding.c | 2 +-
|
|
|
403b09 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
403b09 |
|
|
|
403b09 |
diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/encoding.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/encoding.c
|
|
|
403b09 |
index 9c62f0560aa999b2179a7767040047dfa89288e0..7b2f341229b4f3bf48105c3856c0d6778da154a5 100644
|
|
|
403b09 |
--- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/encoding.c
|
|
|
403b09 |
+++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/encoding.c
|
|
|
403b09 |
@@ -157,7 +157,7 @@ Slapi_Value **ipapwd_encrypt_encode_key(struct ipapwd_krbcfg *krbcfg,
|
|
|
403b09 |
pwd.length = strlen(data->password);
|
|
|
403b09 |
}
|
|
|
403b09 |
|
|
|
403b09 |
- kset = malloc(sizeof(struct ipapwd_keyset));
|
|
|
403b09 |
+ kset = (struct ipapwd_keyset *) calloc(1, sizeof(struct ipapwd_keyset));
|
|
|
403b09 |
if (!kset) {
|
|
|
403b09 |
LOG_OOM();
|
|
|
403b09 |
goto enc_error;
|
|
|
403b09 |
--
|
|
|
403b09 |
2.7.4
|
|
|
403b09 |
|