|
 |
bac598 |
From 81e757b7b1d69893b5725f9c148c55d89c779e7b Mon Sep 17 00:00:00 2001
|
|
|
bac598 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
bac598 |
Date: Tue, 3 Nov 2020 10:12:15 +0100
|
|
|
bac598 |
Subject: [PATCH] ifp: fix use-after-free
|
|
|
bac598 |
MIME-Version: 1.0
|
|
|
bac598 |
Content-Type: text/plain; charset=UTF-8
|
|
|
bac598 |
Content-Transfer-Encoding: 8bit
|
|
|
bac598 |
|
|
|
bac598 |
The variable fqdn is pointing to some data from state->res->msgs[0]. But
|
|
|
bac598 |
before fqdn is used in the next search state->res and the memory
|
|
|
bac598 |
hierarchy below is freed. As a result the location where fqdn is pointing
|
|
|
bac598 |
to might hold the expected data or other data and the search will fail
|
|
|
bac598 |
intermittently.
|
|
|
bac598 |
|
|
|
bac598 |
Resolves: https://github.com/SSSD/sssd/issues/5382
|
|
|
bac598 |
|
|
|
bac598 |
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
|
bac598 |
---
|
|
|
bac598 |
src/responder/ifp/ifpsrv_cmd.c | 1 +
|
|
|
bac598 |
1 file changed, 1 insertion(+)
|
|
|
bac598 |
|
|
|
bac598 |
diff --git a/src/responder/ifp/ifpsrv_cmd.c b/src/responder/ifp/ifpsrv_cmd.c
|
|
|
bac598 |
index 9f20bf2db..d95618127 100644
|
|
|
bac598 |
--- a/src/responder/ifp/ifpsrv_cmd.c
|
|
|
bac598 |
+++ b/src/responder/ifp/ifpsrv_cmd.c
|
|
|
bac598 |
@@ -128,6 +128,7 @@ static void ifp_user_get_attr_done(struct tevent_req *subreq)
|
|
|
bac598 |
tevent_req_error(req, ERR_INTERNAL);
|
|
|
bac598 |
return;
|
|
|
bac598 |
}
|
|
|
bac598 |
+ fqdn = talloc_steal(state, fqdn);
|
|
|
bac598 |
|
|
|
bac598 |
if (state->search_type == SSS_DP_USER) {
|
|
|
bac598 |
/* throw away the result and perform attr search */
|
|
|
bac598 |
--
|
|
|
bac598 |
2.21.3
|
|
|
bac598 |
|