|
 |
ecf709 |
From 27ef368b4105f19382360fe62f944b36ca74adb7 Mon Sep 17 00:00:00 2001
|
|
|
ecf709 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
ecf709 |
Date: Wed, 6 Sep 2017 12:20:25 +0200
|
|
|
ecf709 |
Subject: [PATCH 194/194] certmap: make sure eku_oid_list is always allocated
|
|
|
ecf709 |
MIME-Version: 1.0
|
|
|
ecf709 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ecf709 |
Content-Transfer-Encoding: 8bit
|
|
|
ecf709 |
|
|
|
ecf709 |
If there are only OIDs in a <EKU> part of a matching rule a NULL pointer
|
|
|
ecf709 |
dereference might occur.
|
|
|
ecf709 |
|
|
|
ecf709 |
Related to https://pagure.io/SSSD/sssd/issue/3508
|
|
|
ecf709 |
|
|
|
ecf709 |
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
|
|
|
ecf709 |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
ecf709 |
(cherry picked from commit f5a8cd60c6f377af1954b58f007d16cf3f6dc846)
|
|
|
ecf709 |
---
|
|
|
ecf709 |
src/lib/certmap/sss_certmap_krb5_match.c | 21 ++++++++++++---------
|
|
|
ecf709 |
src/tests/cmocka/test_certmap.c | 17 +++++++++++++++++
|
|
|
ecf709 |
2 files changed, 29 insertions(+), 9 deletions(-)
|
|
|
ecf709 |
|
|
|
ecf709 |
diff --git a/src/lib/certmap/sss_certmap_krb5_match.c b/src/lib/certmap/sss_certmap_krb5_match.c
|
|
|
ecf709 |
index e40f17b8ace46e61087e0a2fa570a362a84cead2..0a77ac225d73f3506e102fdbdc9084faa0f19cf0 100644
|
|
|
ecf709 |
--- a/src/lib/certmap/sss_certmap_krb5_match.c
|
|
|
ecf709 |
+++ b/src/lib/certmap/sss_certmap_krb5_match.c
|
|
|
ecf709 |
@@ -179,19 +179,17 @@ static int parse_krb5_get_eku_value(TALLOC_CTX *mem_ctx,
|
|
|
ecf709 |
goto done;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
+ comp->eku_oid_list = talloc_zero_array(comp, const char *,
|
|
|
ecf709 |
+ eku_list_size + 1);
|
|
|
ecf709 |
+ if (comp->eku_oid_list == NULL) {
|
|
|
ecf709 |
+ ret = ENOMEM;
|
|
|
ecf709 |
+ goto done;
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+
|
|
|
ecf709 |
for (c = 0; eku_list[c] != NULL; c++) {
|
|
|
ecf709 |
for (k = 0; ext_key_usage[k].name != NULL; k++) {
|
|
|
ecf709 |
CM_DEBUG(ctx, "[%s][%s].", eku_list[c], ext_key_usage[k].name);
|
|
|
ecf709 |
if (strcasecmp(eku_list[c], ext_key_usage[k].name) == 0) {
|
|
|
ecf709 |
- if (comp->eku_oid_list == NULL) {
|
|
|
ecf709 |
- comp->eku_oid_list = talloc_zero_array(comp, const char *,
|
|
|
ecf709 |
- eku_list_size + 1);
|
|
|
ecf709 |
- if (comp->eku_oid_list == NULL) {
|
|
|
ecf709 |
- ret = ENOMEM;
|
|
|
ecf709 |
- goto done;
|
|
|
ecf709 |
- }
|
|
|
ecf709 |
- }
|
|
|
ecf709 |
-
|
|
|
ecf709 |
comp->eku_oid_list[e] = talloc_strdup(comp->eku_oid_list,
|
|
|
ecf709 |
ext_key_usage[k].oid);
|
|
|
ecf709 |
if (comp->eku_oid_list[e] == NULL) {
|
|
|
ecf709 |
@@ -225,6 +223,11 @@ CM_DEBUG(ctx, "[%s][%s].", eku_list[c], ext_key_usage[k].name);
|
|
|
ecf709 |
}
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
+ if (e == 0) {
|
|
|
ecf709 |
+ talloc_free(comp->eku_oid_list);
|
|
|
ecf709 |
+ comp->eku_oid_list = NULL;
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+
|
|
|
ecf709 |
ret = 0;
|
|
|
ecf709 |
|
|
|
ecf709 |
done:
|
|
|
ecf709 |
diff --git a/src/tests/cmocka/test_certmap.c b/src/tests/cmocka/test_certmap.c
|
|
|
ecf709 |
index c998443d086eaa72cc2a05c38ddfc5ba590a1ce7..e732bb214476943d0f723b318ab64d3b4156cace 100644
|
|
|
ecf709 |
--- a/src/tests/cmocka/test_certmap.c
|
|
|
ecf709 |
+++ b/src/tests/cmocka/test_certmap.c
|
|
|
ecf709 |
@@ -445,6 +445,23 @@ static void test_sss_certmap_add_matching_rule(void **state)
|
|
|
ecf709 |
assert_null(
|
|
|
ecf709 |
ctx->prio_list->rule_list->parsed_match_rule->eku->eku_oid_list[3]);
|
|
|
ecf709 |
|
|
|
ecf709 |
+ ret = sss_certmap_add_rule(ctx, 96,
|
|
|
ecf709 |
+ "KRB5:<EKU>1.2.3",
|
|
|
ecf709 |
+ NULL, NULL);
|
|
|
ecf709 |
+ assert_int_equal(ret, 0);
|
|
|
ecf709 |
+ assert_non_null(ctx->prio_list);
|
|
|
ecf709 |
+ assert_non_null(ctx->prio_list->rule_list);
|
|
|
ecf709 |
+ assert_non_null(ctx->prio_list->rule_list->parsed_match_rule);
|
|
|
ecf709 |
+ assert_int_equal(ctx->prio_list->rule_list->parsed_match_rule->r,
|
|
|
ecf709 |
+ relation_and);
|
|
|
ecf709 |
+ assert_non_null(ctx->prio_list->rule_list->parsed_match_rule->eku);
|
|
|
ecf709 |
+ assert_true(string_in_list("1.2.3",
|
|
|
ecf709 |
+ discard_const(
|
|
|
ecf709 |
+ ctx->prio_list->rule_list->parsed_match_rule->eku->eku_oid_list),
|
|
|
ecf709 |
+ true));
|
|
|
ecf709 |
+ assert_null(
|
|
|
ecf709 |
+ ctx->prio_list->rule_list->parsed_match_rule->eku->eku_oid_list[1]);
|
|
|
ecf709 |
+
|
|
|
ecf709 |
/* SAN tests */
|
|
|
ecf709 |
ret = sss_certmap_add_rule(ctx, 89, "KRB5:<SAN>abc", NULL, NULL);
|
|
|
ecf709 |
assert_int_equal(ret, 0);
|
|
|
ecf709 |
--
|
|
|
ecf709 |
2.13.5
|
|
|
ecf709 |
|