|
 |
ecf709 |
From 3ee575c2852adb9d5a5c0a4616c082afc6779a8e Mon Sep 17 00:00:00 2001
|
|
|
ecf709 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
ecf709 |
Date: Thu, 1 Jun 2017 09:51:31 +0200
|
|
|
ecf709 |
Subject: [PATCH 152/152] KRB5: Fix access_provider=krb5
|
|
|
ecf709 |
MIME-Version: 1.0
|
|
|
ecf709 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ecf709 |
Content-Transfer-Encoding: 8bit
|
|
|
ecf709 |
|
|
|
ecf709 |
The domain type (posix or not) was being sent to the krb5_child always,
|
|
|
ecf709 |
but the buffer only had enough space in case of authentication, not
|
|
|
ecf709 |
authorization. Bug was introduced in the commit
|
|
|
ecf709 |
861ab44e8148208425b67c4711bc8fade10fd3ed
|
|
|
ecf709 |
|
|
|
ecf709 |
This patch makes the buffer one uint32_t unit larger.
|
|
|
ecf709 |
|
|
|
ecf709 |
To reproduce, just set up sssd.conf with:
|
|
|
ecf709 |
access_provider = krb5
|
|
|
ecf709 |
|
|
|
ecf709 |
Without the patch, you would see messages like:
|
|
|
ecf709 |
==14111== Invalid write of size 2
|
|
|
ecf709 |
==14111== at 0x4C3041B: memcpy@@GLIBC_2.14 (vg_replace_strmem.c:1018)
|
|
|
ecf709 |
==14111== by 0xE0EE275: safealign_memcpy (util_safealign.h:51)
|
|
|
ecf709 |
==14111== by 0xE0EECB3: create_send_buffer (krb5_child_handler.c:239)
|
|
|
ecf709 |
==14111== by 0xE0EFDDE: handle_child_send (krb5_child_handler.c:529)
|
|
|
ecf709 |
==14111== by 0xE0EDEDD: krb5_access_send (krb5_access.c:149)
|
|
|
ecf709 |
==14111== by 0xE0ED32F: krb5_pam_handler_send (krb5_auth.c:1250)
|
|
|
ecf709 |
==14111== by 0x418868: file_dp_request (dp_request.c:254)
|
|
|
ecf709 |
==14111== by 0x418976: dp_req_send (dp_request.c:300)
|
|
|
ecf709 |
==14111== by 0x41C25F: dp_pam_handler (dp_target_auth.c:219)
|
|
|
ecf709 |
==14111== by 0x52B3456: sbus_request_invoke_or_finish (sssd_dbus_request.c:71)
|
|
|
ecf709 |
==14111== by 0x52B0F37: sbus_message_handler_got_caller_id (sssd_dbus_interface.c:1048)
|
|
|
ecf709 |
==14111== by 0x923C923: tevent_common_loop_immediate (tevent_immediate.c:135)
|
|
|
ecf709 |
==14111== Address 0x126ab506 is 150 bytes inside a block of size 151 alloc'd
|
|
|
ecf709 |
==14111== at 0x4C2BBAD: malloc (vg_replace_malloc.c:299)
|
|
|
ecf709 |
==14111== by 0x944D7F4: __talloc_with_prefix (talloc.c:698)
|
|
|
ecf709 |
==14111== by 0x944D7F4: __talloc (talloc.c:739)
|
|
|
ecf709 |
==14111== by 0x944D7F4: _talloc_named_const (talloc.c:896)
|
|
|
ecf709 |
==14111== by 0x944D7F4: talloc_named_const (talloc.c:1675)
|
|
|
ecf709 |
==14111== by 0xE0EE7B6: create_send_buffer (krb5_child_handler.c:185)
|
|
|
ecf709 |
==14111== by 0xE0EFDDE: handle_child_send (krb5_child_handler.c:529)
|
|
|
ecf709 |
==14111== by 0xE0EDEDD: krb5_access_send (krb5_access.c:149)
|
|
|
ecf709 |
==14111== by 0xE0ED32F: krb5_pam_handler_send (krb5_auth.c:1250)
|
|
|
ecf709 |
==14111== by 0x418868: file_dp_request (dp_request.c:254)
|
|
|
ecf709 |
==14111== by 0x418976: dp_req_send (dp_request.c:300)
|
|
|
ecf709 |
==14111== by 0x41C25F: dp_pam_handler (dp_target_auth.c:219)
|
|
|
ecf709 |
==14111== by 0x52B3456: sbus_request_invoke_or_finish (sssd_dbus_request.c:71)
|
|
|
ecf709 |
==14111== by 0x52B0F37: sbus_message_handler_got_caller_id (sssd_dbus_interface.c:1048)
|
|
|
ecf709 |
==14111== by 0x923C923: tevent_common_loop_immediate (tevent_immediate.c:135)
|
|
|
ecf709 |
|
|
|
ecf709 |
Resolves:
|
|
|
ecf709 |
https://pagure.io/SSSD/sssd/issue/3418
|
|
|
ecf709 |
|
|
|
ecf709 |
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
|
|
|
ecf709 |
---
|
|
|
ecf709 |
src/providers/krb5/krb5_child_handler.c | 4 ++--
|
|
|
ecf709 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
ecf709 |
|
|
|
ecf709 |
diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
|
|
|
ecf709 |
index 87e79a06e917aadb622455bccfc2e9c6769f70c2..11ac867e62d2ff96b827cf6d4ff341fc8ff0a286 100644
|
|
|
ecf709 |
--- a/src/providers/krb5/krb5_child_handler.c
|
|
|
ecf709 |
+++ b/src/providers/krb5/krb5_child_handler.c
|
|
|
ecf709 |
@@ -156,14 +156,14 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
|
|
|
ecf709 |
return ENOMEM;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
- buf->size = 8*sizeof(uint32_t) + strlen(kr->upn);
|
|
|
ecf709 |
+ buf->size = 9*sizeof(uint32_t) + strlen(kr->upn);
|
|
|
ecf709 |
|
|
|
ecf709 |
if (kr->pd->cmd == SSS_PAM_AUTHENTICATE ||
|
|
|
ecf709 |
kr->pd->cmd == SSS_PAM_PREAUTH ||
|
|
|
ecf709 |
kr->pd->cmd == SSS_CMD_RENEW ||
|
|
|
ecf709 |
kr->pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM ||
|
|
|
ecf709 |
kr->pd->cmd == SSS_PAM_CHAUTHTOK) {
|
|
|
ecf709 |
- buf->size += 5*sizeof(uint32_t) + strlen(kr->ccname) + strlen(keytab) +
|
|
|
ecf709 |
+ buf->size += 4*sizeof(uint32_t) + strlen(kr->ccname) + strlen(keytab) +
|
|
|
ecf709 |
sss_authtok_get_size(kr->pd->authtok);
|
|
|
ecf709 |
|
|
|
ecf709 |
buf->size += sizeof(uint32_t);
|
|
|
ecf709 |
--
|
|
|
ecf709 |
2.9.4
|
|
|
ecf709 |
|