From 3a4057a37254d6dbb0191da32cd110f7cd50d4e4 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 20 May 2015 18:24:52 +0300 Subject: [PATCH] ipa-kdb: use proper memory chunk size when moving sids Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1222475 Reviewed-By: Tomas Babej --- daemons/ipa-kdb/ipa_kdb_mspac.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c index e3215db4ea11632dce8f039fc6b89c4a09acd87a..74ee2f3fd4b81bd3433c9ff9c77f7434b72e7f4d 100644 --- a/daemons/ipa-kdb/ipa_kdb_mspac.c +++ b/daemons/ipa-kdb/ipa_kdb_mspac.c @@ -1397,7 +1397,15 @@ static krb5_error_code filter_logon_info(krb5_context context, if (result) { filter_logon_info_log_message(info->info->info3.sids[i].sid); } else { + /* Go over incoming SID blacklist */ for(k = 0; k < domain->len_sid_blacklist_incoming; k++) { + /* if SID is an exact match, filter it out */ + result = dom_sid_check(&domain->sid_blacklist_incoming[k], info->info->info3.sids[i].sid, true); + if (result) { + filter_logon_info_log_message(info->info->info3.sids[i].sid); + break; + } + /* if SID is a suffix of the blacklist element, filter it out*/ result = dom_sid_is_prefix(&domain->sid_blacklist_incoming[k], info->info->info3.sids[i].sid); if (result) { filter_logon_info_log_message(info->info->info3.sids[i].sid); @@ -1406,11 +1414,17 @@ static krb5_error_code filter_logon_info(krb5_context context, } } if (result) { + k = count - i - j - 1; + if (k != 0) { + memmove(info->info->info3.sids+i, + info->info->info3.sids+i+1, + sizeof(struct netr_SidAttr)*k); + } j++; - memmove(info->info->info3.sids+i, info->info->info3.sids+i+1, count-i-1); + } else { + i++; } - i++; - } while (i < count); + } while ((i + j) < count); if (j != 0) { count = count-j; -- 2.1.0