Blame SOURCES/0105-nss-idmap-use-right-group-list-pointer-after-sss_get.patch

ab1ddb
From c3e0098383fb199d678df54bfd129123a8184e70 Mon Sep 17 00:00:00 2001
ab1ddb
From: Sumit Bose <sbose@redhat.com>
ab1ddb
Date: Wed, 18 Apr 2018 10:23:22 +0200
ab1ddb
Subject: [PATCH] nss-idmap: use right group list pointer after sss_get_ex()
ab1ddb
ab1ddb
If the initial array is too small it will be reallocated during
ab1ddb
sss_get_ex() and the pointer might change and the initial memory area
ab1ddb
should not be used anymore.
ab1ddb
ab1ddb
Related to https://pagure.io/SSSD/sssd/issue/3715
ab1ddb
ab1ddb
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
ab1ddb
(cherry picked from commit 2c4dc7a4d98c439c69625f12ba4c3c8253f4cc5b)
ab1ddb
---
ab1ddb
 src/sss_client/idmap/sss_nss_ex.c | 18 +++++++++---------
ab1ddb
 1 file changed, 9 insertions(+), 9 deletions(-)
ab1ddb
ab1ddb
diff --git a/src/sss_client/idmap/sss_nss_ex.c b/src/sss_client/idmap/sss_nss_ex.c
ab1ddb
index f56bffcc24a7e2503e23a892541a9242ed4b5069..5bcfe8850b5355d6cbe0efc5e52fe076737f2a08 100644
ab1ddb
--- a/src/sss_client/idmap/sss_nss_ex.c
ab1ddb
+++ b/src/sss_client/idmap/sss_nss_ex.c
ab1ddb
@@ -485,7 +485,6 @@ int sss_nss_getgrouplist_timeout(const char *name, gid_t group,
ab1ddb
                                  uint32_t flags, unsigned int timeout)
ab1ddb
 {
ab1ddb
     int ret;
ab1ddb
-    gid_t *new_groups;
ab1ddb
     long int new_ngroups;
ab1ddb
     long int start = 1;
ab1ddb
     struct nss_input inp = {
ab1ddb
@@ -498,27 +497,28 @@ int sss_nss_getgrouplist_timeout(const char *name, gid_t group,
ab1ddb
     }
ab1ddb
 
ab1ddb
     new_ngroups = MAX(1, *ngroups);
ab1ddb
-    new_groups = malloc(new_ngroups * sizeof(gid_t));
ab1ddb
-    if (new_groups == NULL) {
ab1ddb
+    inp.result.initgrrep.groups = malloc(new_ngroups * sizeof(gid_t));
ab1ddb
+    if (inp.result.initgrrep.groups == NULL) {
ab1ddb
         free(discard_const(inp.rd.data));
ab1ddb
         return ENOMEM;
ab1ddb
     }
ab1ddb
-    new_groups[0] = group;
ab1ddb
+    inp.result.initgrrep.groups[0] = group;
ab1ddb
 
ab1ddb
-    inp.result.initgrrep.groups = new_groups,
ab1ddb
     inp.result.initgrrep.ngroups = &new_ngroups;
ab1ddb
     inp.result.initgrrep.start = &start;
ab1ddb
 
ab1ddb
-
ab1ddb
+    /* inp.result.initgrrep.groups, inp.result.initgrrep.ngroups and
ab1ddb
+     * inp.result.initgrrep.start might be modified by sss_get_ex() */
ab1ddb
     ret = sss_get_ex(&inp, flags, timeout);
ab1ddb
     free(discard_const(inp.rd.data));
ab1ddb
     if (ret != 0) {
ab1ddb
-        free(new_groups);
ab1ddb
+        free(inp.result.initgrrep.groups);
ab1ddb
         return ret;
ab1ddb
     }
ab1ddb
 
ab1ddb
-    memcpy(groups, new_groups, MIN(*ngroups, start) * sizeof(gid_t));
ab1ddb
-    free(new_groups);
ab1ddb
+    memcpy(groups, inp.result.initgrrep.groups,
ab1ddb
+           MIN(*ngroups, start) * sizeof(gid_t));
ab1ddb
+    free(inp.result.initgrrep.groups);
ab1ddb
 
ab1ddb
     if (start > *ngroups) {
ab1ddb
         ret = ERANGE;
ab1ddb
-- 
ab1ddb
2.14.3
ab1ddb